Assigning roles and permissions Drupal 7
If you go on www.yoursite/admin/people/permissions#module-user you can decide witch kind of user can edit user permissions, so in your case only admin and shop_admin.

Of course you do not want the shop_admin to edit admin permissions, and all the pages where you can edit single user permissions are forms so you can use hook_form_alter in order to hide unwanted options or add conditions based on user role