In Drupal core, there is a single permission 'administer users' that controls whether a user can 'administer' the user account of another user. However the Drupal 8 Entity API makes it possible to refine the access, for example by means of hook_entity_access. This allows modules such as Administer Users by Role to create a "sub-admin" - a user without 'administer users' permissions that nevertheless has access to update some other users' account.
Drupal allows an admin with permission 'administer users' to create/edit/cancel a user with a blank email address. However there is no easy way for a site to extend that permission to a sub-admin. That means that a sub-admin cannot even edit or cancel an account with blank email address unless they set a value for the field.
We should provide a hook to alter permission to assign a blank email address. A secondary use of the hook is so a site can have a policy that blank emails are not allowed, even for a full admin.