Restrict a role to administer certain vocabularies and terms, and remove the access to creating vocabularies
"Creating a new vocabulary" is what you do using the URL admin/structure/taxonomy/add, while "Editing existing vocabularies" (say with machine name demotags) is done using the URL admin/structure/taxonomy/demotags/edit.

A possible solution to "restrict" access to these URLs (which seems to be the missing piece you are looking for) is to use the Rules module for this. To do so, have a look at my answer to the question "How to make the permissions of a module more granular?". It includes a rule (in rules export format), which you should be able to use if you apply these minor tunings to it:


Check the Rules Condition about which roles this validation should be applied for (if any, if not remove that condition).
Adapt the Rules Condition with the URLs containing visitors (to match the taxonomy related URLs like in my first paragraph).
You probably don't need the Rules Condition with the "regex" in it (you only have a few URLs to be validated). In that case, you don't need the "OR" part either.
Review the Rules Action (the message you want to show, and the redirect you want to force).