You can sort of restrict 'domain admins' by removing the builtin/admin for the admin group (not exactly advisable) as this can cause problems with full text indexing etc.