Another solution which prevents a smart "admin" from still accessing the pages via url and tabids is:
Create a user group called localAdmin (or whatever you want to call it)
Create a new page call it Admin. Set view/edit rights for localAdmin group you just created.
Goto the admin / host tabs that you want the admin to have rights to and record the tabid.
Goto any normal page and edit settings for the page, now replace the tabid in the url with the tabid you recorded. When you hit enter you will have the page settings for the admin control page. Now give the local admin view and edit rights, And set it's parent page to the new admin page you created above. This moves the page underneath the new Admin page.
There you go.
Now this method works for everything except User groups, and Users admin controls. If you need admins to have that access, then you can do a reverse method where you move the admin controls to a Host only page, leaving the admin controls you want site admins to have access to.
NOTE A VERY IMPORTANT PIECE OF INFORMATION THIS IS ONE WAY METHOD. IT IS NOT EASILY REVERSED WITHOUT GOING INTO THE DATABASE AND MAKING CHANGES.
If its not a really big issue / problem for you. I suggest you wait till the release of DNN 5.0 which has this support built in. However, if you really need to limit what your admins have access to cause there is a overall risk to the site, then this method will work.