The reasoning for this question is questionable ...
To critique your desired solution of creating a new user -- even if other root users can't change new-user's password they don't need to since root can read any file or change the file permissions of the file -- they don't ever need to "be" that user."
I you have terabytes of data you want to prevent other users from accessing - don't put that data on the same machines those users have access to.
If you have terabytes of data on a machine with multiple users - why would you not what those users to access the data?
And we haven't even gotten to the point of talking about why have multiple root users you don't trust. Granted multiple root users is a good thing, however it sounds like you have root access for all users - friends are great, and let them in, but they don't need root.
Even using an ACL you can not prevent another root user from getting to the data - you(as root) created the ACL, they(as root) will modify it.
The only truly viable solution is what the various spook agencies invented a long time ago. Air gap'd machines.
Put your "top secret" data on a drive, and don't plug it into the machine with your friends. Or, install the drive onto a different machine without a zoo of root users, and which has no network access. You can probably get away with allowing this machine (file server) to have network access, since you're friends aren't likely to have Spook Grade hacker tools to gain access to this machine. Give only yourself access, and voila - isolated data. This sort of machine is very cheap to create. CPU, NIC and done.
If you "kind of want" to trust them, and/or, and only access this data from this (root-user-clutered) machine then only physically connect the drive when in single user mode, offline, and you are at the console.
There are perhaps some other creative solutions, however if it involves software it is not possible to isolate one root user from another root user.
ps: when referring to root, I am using that term to imply a true root user - not a user with sudo, etc.