Create Custom Multisite User Role to Reduce Capabilities

Question

I need to create a new role for my multisite install for our Technical Account Managers so that they are only able to create/edit/remove users and create/edit/remove sites. I'm pretty sure I've tracked down the correct capabilities I need to use for my new role, but I'm not sure how to apply it only to the network wide users area (currently the only available roles for those users are Super Admin or Admin).

I've been able to create a new role that is currently available for individual site users, but I need this to only be available on the network level. Any ideas on how to apply the code below to network users only and if possible generate a drop-down for role selection when creating a new network user?

functions.php

// Add custom user role
$role = add_role('tam', 'Technical Account Manager', array(
  'manage_sites' => true,
  'manage_network_users' => true,
  'edit_themes' => false,
  'install_plugins' => false,
  'update_plugin' => false,
  'update_core' => false
));