Any role that can create users can create Super Admin user

Discord Q&A strapi-questions
16

:warning: We do not guarantee the internal APIs will be stable over time and this si definitely playing with them.

Another method is to intercept the route itself and add a middleware

  const routeConfig = strapi.admin.routes.admin.routes.find(
    (route) => route.path === '/users' && route.method === 'POST'
  ).config;

  routeConfig.middlewares = [...(routeConfig.middlewares ?? []), handler];