Can I ensure that only site admins can create projects?

You can do this using Velocity.

Create /opt/collabnet/teamforge/sourceforge_home/templates/body_footer.vm and populate it with this:

#set($superUser = ${PAGE_INFO.isSuperUser()}) 
#if($superUser == false) 
<script>
if(document.getElementById("createProject") != null){ 
var e = document.getElementById("createProject").parentNode.parentNode; 
while (e.firstchild) { 
e.removeChild(e.firstChild); 
} 
} 
</script>
#end

Save the file, and TeamForge will start hiding the button for non-site admins immediately.