Server role with permission only to create server login, not alter one
CREATE and ALTER are tied together into ALTER ANY. What is the actual goal? If you're going to give a person the rights to create logins, why block from alter? Whatever you think they might try to do, they could just create an additional login instead of changing an existing one, or drop/create the original.

You could possibly block ALTER LOGIN commands via a DDL trigger depending on the caller, but that is quite different from permissions.