Take advantage of the quotas feature and allow the Organization Owner to set a number of mirrors per organization that is settable to 0 (so to disable mirroring).

This will allow to give Owner roles to certain users but without them being able to mirror repositories (as a customer scenario constraints dictates).

Preferably, this quota setting should be overriddable by Admin.

Background: the customer wants to allow users of an organization to create oauth tokens, but this is only possible if they are organization owner. Organization owners can also create repo mirrors and this is not desired by this particular user.