Hi,
I am not sure if you only need to use permissions to solve that. But if you want to then you'll need to create a new Permission to handle that, if not.
You can hide the New Folder by editing toolbar.lib.ftl
and you put <#if !user.isAdmin> and it's closing tag, where they create that button.
Check the code below. you can also edit it to suit your need, because this one will only show it to users with admin rights.
<#if !user.isAdmin>
<div class="hideable toolbar-hidden DocListTree" style="display: none;">
<div class="new-folder"><button id="${args.htmlid}-newFolder-button" name="newFolder">${msg("button.new-folder")}</button></div>
<div class="separator"> </div>
</div>
</#if>
Hope this helps.
Regards,
Croc