I want to have a moderator who can moderator all the other moderators but still not have as much access to change forum settings as I (the Administrator) do.

What is the best way to achieve this?

Should I create a third group which is actually a moderator with full access while limiting all the regular moderators privileges?

Or should I create a second Admin but limit his privileges?

I basically need to make sure that no Administrator besides myself can hijack the whole forum and change sensitive forum code or do things like version upgrades.

How have you guys handled this?

Follow this:

 

Thanks! And how can I control which groups are not allowed to ban members & and which groups are allowed to ban moderators?

Members
Can ban/unban members (mod = member, no mod setting)
Can ban admins

Viewing accounts may need to be on as well, to ban.

It's all there if you go through it. Test it out. 

I don't understand what you said. Where in AdminCP can I set permissions for moderators to not ban members?

Staff
Administrators
Add/Edit
System Tab in the admin restrictions, then Members.

Ah... I see! Thanks!