We have a mix of internal and external spaces in our Confluence instance and have had to limit space administration rights because of security concerns. However this is limiting to our internal users who want to use the other tools and do things like create templates, etc. so just blocking access to Permissions would be the perfect solution