There is a setting where you can control which user groups a user from a given user group can set on other users that they create.
It is a bit hidden, and easy to miss, which can be confusing when users cannot create users having certain usergroups.
Go to General > Settings > Roles/Groups > User groups
Click on the edit icon in the "Actions" column for the user group in question.
In the User Group dialog, there is a section called "Can not set these User groups on users"
The current user group can not:
- create users with the selected user groups
- set those user groups on existing users
The reason for this is so you can put in restrictions on user creation, so that only administrators can create other administrators, for example.