Over the years, we have just gotten into the habit of logging into GP with the "SA" account to do a variety of task; one such task is creating other GP Users.
Mark Polino recently posted a fantastic blog post on how to give a GP User the ability to create other GP Users without giving them the SQL "SA" password.
He also goes on to explain how a GP user cannot login to SQL Server with their GP credentials with other tools, such as SQL Server Management Studio.
Here is his post, so give it a read and enjoy.
Until later,