There aren't fine-grained permissions to enable you to "lock down" manipulation of "Local Users and Groups" (the old registry SAM hive). It's not a matter of there being no syntax for the Security Template, but rather there's just no functionality to do this. You can't "delegate" or restrict permission to modify the SAM on a machine-- the product just can't do it.
Access to the SAM is only "allowed" through APIs that access the SAM and SECURITY hives of the registry. These APIs make the security checks and, to my knowledge, these checks are hard-coded. There isn't somewhere that you can change permissions to alter the behavior of these APIs. All the programs you describe use these APIs to make changes to the registry. You CAN'T delegate control of the SAM to limited users, other groups, etc-- it's hard-coded in the product.
If you don't want users mucking about with things that only "Administrators" are allow to do don't make them "Administrators. Anything else you try to do, so long as they are still members of the "Administrators" group, is a futile attempt and can be un-done by the user.
Some background on the architecture is here: http://technet.microsoft.com/en-us/library/cc961760.aspx?ppud=4
Old Windows NT 4.0 domains used the SAM as their back-end storage for accounts and groups and suffered from these limitations in the ability to delegate control. That was yet one more reason by Active Directory was better than NT 4.0. Insofar as the SAM on individual PCs we're still in the NT 4.0 days, in terms of delegation functionality, even on Windows 7 (and I don't see that ever changing).