Okay, so the code above does work, but not for super admins, you must explicitly remove permissions from super admins, like this:
// restrict super admin capabilites
add_filter('map_meta_cap', 'restrict_super_admins', 10, 4);
function restrict_super_admins($caps, $cap, $user_id, $args){
$super = array(
'add_users',
'create_users',
);
if( in_array($cap, $super) ) {
$caps[] = 'do_not_allow';
}
return $caps;
}