Not out of the box; you're going to end up with custom code. One way would
be to alter the Create Site form to hide this control under the proper
circumstances; you might be able to do it with an audience-targeted web part
(where instead of audiences you use security groups).

I've been looking at writing custom code, but just wanted to make
sure I wasn't making it harder than it should be.