There is currently no special role in Alfresco that you can assign to users to allow them to create other users without having full admin privileges... Technically speaking there is also no special permission for this so even if you were to create a custom role there is no way to differentiate this from other admin actions.
Might as well just set up an LDAP directory, configure Alfresco to authenticate against that, and then use an out-of-the-box client to manage users/groups in your LDAP directory or write your own webapp to do the same. That way you have full control over user/group management, and a directory that can be leveraged not just for Alfresco, but for other apps in your environment.
