Postgres: Deny user from altering own role

Question

How can I allow a Postgres user to be able to create new roles, but not create a database? The problem I currently have is, if I grant CREATEROLE and NOCREATE