I would suggest domain admin [1] to create another users rather then granting any regular user to create another ones. As you would need not only create the user, but also be able to assign appropriate role to it, which should not be granted for members for sure.
I'm not actually sure about your usecase, but what regular _member_ can do, is to create application credentials [2], that can be used for authentication in keystone by clients (including usage of openrc/clouds.yaml files), but that will basically shadow user that has created these credentials. Though they can't be used to auth in Horizon if I'm not mistaken.