Allow a role to assign user roles but not to manage user permissions
Use the role delegation module


  This module allows site administrators to grant some roles the
  authority to assign selected roles to users, without them needing the
  administer permissions permission.
  
  For each role, Role Delegation provides a new assign ROLE role
  permission to allow the assignment of that role.