I'm going to tentatively mark this as a dupe of #4477, as this issue is prevalent across the whole host creation/edit form (e.g. with domains). The form wouldn't work well today if we restricted the related resources that users could see, as it would break on edit.

You raise an interesting point about the create_hosts permission - I don't think the filter would be applicable at all here, only for permissions that dealt with existing objects (i.e. view_hosts, power etc.) We'd likely only show host groups that match "view_hostgroups" if we did it.