thank you for quick response, but as far as i read there is still option for delegated admin to create and delete users, and it is not read only 
or i misunderstood this ?
client based access: do you mean the next if i have 100 users, i should create one more role and add this role to 100 users?