We faced this issue and solved it by creating  a custom  web part that allowed users  to add  other users, but not access or change  user rights. We found no way out of the box to do that.

I would have to agree that there is no othe way to do this. You could
do this with a custom  webpart that uses impersonation to an account
that has the rights  perform an add. Should only take a day or two to
write.

I have also not found a way to accomplish this. Another point is that
it's very risky to allow users  to manage security on their own sites,
especially if those sites contain sensitive data. Most users have no
clue what site  groups are and what they mean. If a site is uniquely
permissioned (a library or list with different rights  than the site
itself) what usually happens is the site administrator  forgets how
security was set up and invariably increases a user's rights to give
them access. Eventually, you have nothing but administrators on the
site.

We use Active Directory groups, which have their own disadvantages, but
it allows specific roles to be assigned through those AD groups and
gives the site owner the authority to have users added but not the
ability. The site owner contacts the help desk, a ticket is created  to
add the user, and the help desk does the security administration via
AD. This gives us an audit trail as well as insolates the site from
users who like to tinker with FrontPage or Dreamweaver.

In v2 (I assume because you are talking about Custom Site Groups rather
than Permission Levels), you cannot choose part of the Manage Web Site
right.

In v3, I don't think that you can do it either but there are potentially
events that you could tap into. However, user management doesn't have
events. But there is a User Info Gallery which is, of course, a list.
So, it is theoretically possible to write events for that. I say
theoretically because in B2TR you couldn't but perhaps RTW fixed that.