How can I enable moderator role's ability to administer users only apply to certain user roles?
There is quite a new contrib module called "Permissions subset" for D7 you could test if it meets your requirements.