multisite plugin management

I am getting very frustrated with multisite plugin management. Or I just don’t understand it.
WP offers 2 choices for each plugin.
1) ‘network activated’ which activates the plugin for all sites, and does not allow them to deactivate it.
2)’network deactivated’ which does not actually deactivate the plugin but rather allows each site to decide whether to activate it or not.

What I need is site-by-site control over the ‘activation state’ of the plugin, and I see that there are several plugins which provide that.
The problem is that with site-by-site control a third activation state becomes important:
1) activated — site cannot deactivate (‘network activate’)
2) optional — site can activate or deactivate (‘network deactivate’)
3) deactivated — site cannot activate (???)

Is there a plugin that does this?
The ones I have seen (Multisite Plugin Manager and Advanced WPMU Plugin Manager) only seem to provide site-by-site control of the two options provided by WP.