User Roles to Create Virtual Desktops only

I would like to know the minimun  roles neccess to allow a user to just be able to create virtual machines and not have access to do no harm. I have looked at the different roles but each one has sever options checked and unchecked.