How to create a new user in a remote offline database without elevating roles
Use a signed stored procedure. The right to alter logins is encapsulated within the SP. The users only have rights to execute the SP, not amend logins directly. You may need several SPs to cover different aspects for administration.