Disassociate permissions of Upload Images and Create Snapshots

At this moment, permission of upload images to openstack and to create instance snapshots are linked.
Customer wants to allow user to create their own instance snapshots but not to upload new images to openstack, because they want to control that only images controlled by the security team are deployed in the infrastructure.

Use Case:

Customer want to control that only approved images are uploaded to Openstack, and they will control from the admin view versions and patching but they want to allow users to create snapshots of their running vms and use that snapshots to create new vms.
If the user want to create an image from that snapshot, they will have to ask the admin guys to create it Customer knows that it is ok for them.