Is there a CLEARLY defined procedure for removing "View Mail" by delegating most other admin rights to certain administrative users?

I have tried the "zmprov grr global use username@domain.com -adminLoginAs" but get an Invalid Request when applied to a global admin.

Can this be done thru the GUI or must it be CLI only?