I can’t think of any built in way of doing this as roles don’t have a specified control over create without also removing the ability of the other users to edit. I think you would need to create a role for users that can create and in edit view check if a user is in that group to allow editing.
Going further would be to remove the create lead button from views if a user isn’t in the create lead role.
I think that this is possible but I’m not sure 100% that my solution works…
You can have an user in two security groups at the same time. So, you could have your users and groups same now without permissions to create leads and after add this “one person” to another group with permission to create lead.