Users in admin level should have permission only to provide permission to closure but not to other.
UseĀ conditions in your workflow, then have a look at https://confluence.atlassian.com/adminjiraserver073/managing-project-permissions-861253293.html
It looks like you're new here. Sign in or register to get started.