Below you have an example of how I do it in most cases:

DOM="domain.com"
DOM_ADMIN="admin@domain.com"


echo "ma $DOM_ADMIN zimbraIsDelegatedAdminAccount TRUE
ma $DOM_ADMIN zimbraAdminConsoleUIComponents cartBlancheUI zimbraAdminConsoleUIComponents domainListView zimbraAdminConsoleUIComponents accountListView zimbraAdminConsoleUIComponents DLListView zimbraAdminConsoleUIComponents aliasListView

ma $DOM_ADMIN zimbraDomainAdminMaxMailQuota 0
md $DOM zimbraDomainMaxAccounts 1
grantRight domain $DOM usr $DOM_ADMIN -createAccount
grantRight domain $DOM usr $DOM_ADMIN +createAlias
grantRight domain $DOM usr $DOM_ADMIN +createCalendarResource
grantRight domain $DOM usr $DOM_ADMIN +deleteAlias
grantRight domain $DOM usr $DOM_ADMIN +listDomain
grantRight domain $DOM usr $DOM_ADMIN +domainAdminRights
grantRight domain $DOM usr $DOM_ADMIN +domainAdminConsoleRights
grantRight domain $DOM usr $DOM_ADMIN +adminConsoleAliasRights
grantRight domain $DOM usr $DOM_ADMIN -configureQuota
grantRight domain $DOM usr $DOM_ADMIN set.account.zimbraAccountStatus
grantRight domain $DOM usr $DOM_ADMIN set.account.sn
grantRight domain $DOM usr $DOM_ADMIN set.account.displayName
grantRight domain $DOM usr $DOM_ADMIN set.account.zimbraPasswordMustChange
grantRight domain $DOM usr $DOM_ADMIN +getDomainQuotaUsage
grantRight domain $DOM usr $DOM_ADMIN -deleteAccount
grantRight domain $DOM usr $DOM_ADMIN +createDistributionList
grantRight domain $DOM usr $DOM_ADMIN +addDistributionListAlias
grantRight domain $DOM usr $DOM_ADMIN +addDistributionListMember
grantRight domain $DOM usr $DOM_ADMIN +deleteDistributionList
grantRight domain $DOM usr $DOM_ADMIN +domainAdminDistributionListRights
grantRight domain $DOM usr $DOM_ADMIN +getDistributionList
grantRight domain $DOM usr $DOM_ADMIN +getDistributionListMembership
grantRight domain $DOM usr $DOM_ADMIN +listDistributionList
grantRight domain $DOM usr $DOM_ADMIN +modifyDistributionList
grantRight domain $DOM usr $DOM_ADMIN +removeDistributionListAlias
grantRight domain $DOM usr $DOM_ADMIN +removeDistributionListMember
grantRight domain $DOM usr $DOM_ADMIN +renameDistributionList
grantRight account $DOM_ADMIN usr $DOM_ADMIN -deleteAccount
grantRight account $DOM_ADMIN usr $DOM_ADMIN +getAccountInfo
grantRight account $DOM_ADMIN usr $DOM_ADMIN +getAccountMembership
grantRight account $DOM_ADMIN usr $DOM_ADMIN +getMailboxInfo
grantRight account $DOM_ADMIN usr $DOM_ADMIN +listAccount
grantRight account $DOM_ADMIN usr $DOM_ADMIN +removeAccountAlias
grantRight account $DOM_ADMIN usr $DOM_ADMIN +renameAccount
grantRight account $DOM_ADMIN usr $DOM_ADMIN +setAccountPassword
grantRight account $DOM_ADMIN usr $DOM_ADMIN +viewAccountAdminUI
grantRight account $DOM_ADMIN usr $DOM_ADMIN -configureQuota" > /tmp/dom_admin

cat /tmp/dom_admin | zmprov

Some tips:

zimbraDomainAdminMaxMailQuota define how many accounts that domain may have. It prevents that admin to create more accounts than this limit.

-configureQuota prevent admin from changing accounts quotas.

There are many options available but those are the ones that works for me in most cases.