Hello Pedro. Unfortunately system administrator accounts are just that, and have access to the whole system. The primary domain administrator should have impersonate rights though, does this not accomplish your goals?
Kyle Kerst
Lead Internal Network/System Administrator
SmarterTools Inc.
smartertools.com