Set ‘registrations is disabled’ to stop new users from registering new sites.
‘Add New Users’ needs to be unchecked!
‘Enable administration menus’ the plugins box must be unchecked.
Do not grant any user ‘super admin’ privileges. That box needs to be unchecked.
Site admins can enable or disable plugins on their site. They can’t disable plugins that are enabled network-wide. You’ll need to keep that in mind.
Site admins will be able to configure plugins that are enabled on their site but they can’t configure network-enabled plugins.
From the site admin page (instead of the network user admin page) you should set the user roles to something less than admin to limit their capabilities.
An admin is an admin of a particular site but not all sites and not a super admin unless you grant them that role.
User roles and capabilities are discussed here very well…
https://wordpress.org/support/article/roles-and-capabilities/
Themes have the ability to be hidden from some sites from the network admin pages. You’ll need to do your homework on this if you need it and it centers mostly around the network-enabled settings.
Read More about this… https://wordpress.org/support/article/network-admin/#themes
