if set to the most restrictive setting, no one (including no service principal) can invite guest users.
only users with admin roles means:
can invite guest users.
Microsoft decided to stop creating un-managed tenants for guests. The new logic is simple:
if the guest is:
The identity provider is contacted for sign-in.
In all other cases, email authentication (code) will be used.