There's no separation possible here. Admin rights are needed to do all of that, and admin rights mean you can modify everything.
You do have options though. The "admin means admin" statement applies, but you can shift or delegate some of it.
In Jira, you can set your permissions to use project roles instead of groups (I very strongly recommend doing that). Project administrators can maintain who is in the roles in their project, so you can delegate most of the user maintenance to them. As an example, I worked at a place that had 11 Jira admins for 50,000 people. When I started, there was simply too much user/group maintenance, so I shifted my area from groups to roles. We still had 11 admins, but 8 of them in France did nothing but user maintenance and the 3 in the UK where we'd moved to roles suddenly had time to do stuff like real support, housekeeping, upgrades etc.
If you use an external user directory (Crowd, LDAP, etc), you can grant people rights in there to maintain user information without giving them any admin rights in Jira.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.