Always start include thru leads

[joebordes]

You are right this cannot be done using permissions system because if you block account creation you will not be able to convert the lead.

I would create a custom validation rule for accounts to detect that the user is trying to create and inform them that it is not allowed. Validation rules are not executed on lead conversion.