Only Admins can change SecurityGroup on Folders and Sessions

Hi Support,
after it is not possible to break inheritance from a folder tree. I'm searching another way to reach my goals.
My users need to Add, Edit and Delete Sessions on several folders. So they need the same richts on the folders above. But they can also change the SecurityGroup on a folder to another SecurityGroup on which they have access. They also can change the SecurityGroup to <None>, which makes this Entry public.
Is there a way that only Admins can change the SecurityGroup? Or a button to disable the SecurityGroup dropdown for some Groups or a deny right or anything else? :)
thanks,
Ben