Domain controller users and computer OU delegation

Hi

Is it possible to setup AD users and computers  in a way in which users can ONLY modify the computer OU? How do I set this up?

We are setting up a new platform. The platform is setup with a backup domain controller. The primary domain controller is in a different location. does the backup domain controller need to have global catalogue enabled?