I do not think this can be done out-of-the-box unless this has recently been added as a config option that I don't know about.
You could write a module that checks the current user's group membership and then shows/hides the Create Site UI action accordingly. It wouldn't prevent people from using the API to create a site, but at least they wouldn't be able to do it through the UI.