SCM Permission - access for creating stream and components

I would use the second approach ... creating a special role for the purpose.  Only someone who can give members additional roles in a team area would be able to give someone that special role, and if they are responsible for assigning roles, you should be able to trust them to do the assignments in a responsible fashion.   If you really want/need to control this, you can write a custom process adviser to enforce it.

Note that it is common to let most developers create streams, since you can always just delete the ones you decide you don't want.   Also note that although you can control by permissions who can assign ownership of a component to a given project/team area, you cannot prevent someone from creating a personal component.