While it's entirely possible to implement it as Ray Carnes has done (As a bonus it even gives you the ability to raise a custom warning, rather than the generic permission denied message, which is why I prefer his method), I just wanted to show that a rule like this can easily be implemented through the access rules.

While individuals and companies are the same model, you can restrict CRUD permissions on a model by domain filtering. Therefore we can give Create/Delete permission to a group only when the is_company field is false.

(Using v11, though similar for v9/10)

In Settings -> Users & Companies (Users in v9-10) -> Groups -> Extra Rights /  Contact Creation -> Rules -> Edit -> Add an Item -> Create

From here you can create a rule. 

Object: res.partner

Access Rights: Create (And possibly delete, depends on your needs)

Rule definition: [('is_company', '=', False)]

Groups: Extra Rights / Contact Creation

Note: if another rule exists regarding res.model models, things get a little trickier. Read the "Interaction between rules" section on the creation menu for more information.