Welcome to the forums,
In 5.0 you'll have to make your own zimlet to hide it - or other custom soap portal - there's no user levels in FOSS, while NE has a fixed domain admin.
In 6.0 we're moving to delegated rights in NE (& possibly FOSS) so you'd remove adminLoginAs permission on a group (DL) or account:
zmprov rvr account
user@domain.com adminLoginAs
There's also:
Bug 19386 - "View Mail" should be able to view "passively" Bug 6032 - Non-Modifying 'View Mail' admin permission/role
---
Another example:
zmprov mdl
group@domain.com +zimbraAdminConsoleUIComponents DLListView
zmprov grr global grp
group@domain.com getDistributionList
Obviously you'll want to set others like:
addDistributionListAlias
addDistributionListMember
createDistributionList
deleteDistributionList
domainAdminDistributionListRights
getDistributionList
getDistributionListMembership
getDistributionListShareInfo
listDistributionList
modifyDistributionList
publishDistributionListShareInfo
removeDistributionListAlias
removeDistributionListMember
renameDistributionList
setDomainAdminDistributionListAttrs
viewDistributionListAdminUI
Then on the account:
zmprov ma
user@domain.com zimbraIsAdminAccount TRUE
(not zimbraIsSystemAdminAccount)
Now what's the difference for NE in GnR? Well the com_zimbra_delegatedadmin zimlet is only bundled with the network edition, and allows for easy setup via the admin console:
There's also a Global Settings > Permissions tab, or if you need to set something at the server level Servers > server > Permissions tab:
Or even the user level via account > permissions tab.