While it's entirely possible to implement it as Ray Carnes has done (As a bonus it even gives you the ability to raise a custom warning, rather than the generic permission denied message, which is why I prefer his method), I just wanted to show that a rule like this can easily be implemented through the access rules.
While individuals and companies are the same model, you can restrict CRUD permissions on a model by domain filtering. Therefore we can give Create/Delete permission to a group only when the is_company field is false.
(Using v11, though similar for v9/10)
In Settings -> Users & Companies (Users in v9-10) -> Groups -> Extra Rights / Contact Creation -> Rules -> Edit -> Add an Item -> Create
From here you can create a rule.
Object: res.partner
Access Rights: Create (And possibly delete, depends on your needs)
Rule definition: [('is_company', '=', False)]
Groups: Extra Rights / Contact Creation
Note: if another rule exists regarding res.model models, things get a little trickier. Read the "Interaction between rules" section on the creation menu for more information.