System Administrator role

I am wondering if anyone has been through this situation before.

We would like to grant access to the System administrator responsibility for some staff. I understand we could create a customized System admin role by restricting to only the (security > user > define). I am wondering in that fnd_user screen if we could further restrict it where a user are unable to add certain responbilities to their own account, like HR, Payroll etc. W