1) network activate URE;
2) turn ON ‘Allow non super administrators to create, edit, and delete users’ option at ‘Network admin->Settings->User Role Editor->Multisite’ tab;
3) create new role, e.g. user_manager, at the main site via ‘Network Admin->Users->User Role Editor’;
4) add to it these capabilities: read, list_users, create_users, edit_users, delete users, promote_users, remove_users.
5) click ‘Update Network’ button to replicate this role to all subsites of your network.
6) assign this role to a user via ‘Network Admin->Users’: click ‘Capabilities’ under selected user row.
7) add this user with permissions granted together to all subsites of a network – click ‘Update Network’.
You need to repeat the replication steps (Update Network) for role and user after a new subsites was added.