what is the best way to give permission a particular group/user for domain joining..?

I m using windows server 2008 r2 DC......by default my all user able to join domain ..................

that decrease my security level.....

so how can i remove this permission and how can i provide permission to a special user/group to  join domain