We need the a role to be able to create/manage client portal users, but they don't need to have the permission of user management.