For each of your "restricted" administrator, make sure the user account does not belong to "MobiControl Administrator" user group, and just manually configure the permissions/options of EACH device-group/-subgroup he/she can access in the "Device Group Permission" tab after clicking the  Users/Console Security item in the main pop-up menu.  

Additional to Raymonds comment:

We do that by creating different usergroups for eg. countrys etc. configure those with permissions on folders and functions and then assign them to the users who should have access to those.

Then you are most flexible and fast with assigning rights even to new users etc.