Only members of the sysadmin and dbcreator fixed server roles can execute sp_attach_db and sysadmin to run sp_detach_db.
db_backupoperator can run backup and dbcreator is able to execute restore.
I suggest you to control how and where the databases are created and database files be located, no users.