You can only specify a single creationBaseDn per directory: this is the node in the LDAP tree under which entries created by Nuxeo will be placed in LDAP.

The Nuxeo Directory API is structure agnostic: it sees entries as a flat collection (as is naturally the case when using the SQLDirectory implementation) and it does not expose the tree structure of the LDAP server to the caller. Hence there could be only a single creationBaseDn per directory configuration.

Edit: If you want to disable the creation of entries in Nuxeo you can set the directory in readonly mode: <readOnly>true</readOnly>. Have a look at the examples in the doc to know where to put this parameter in your configuration file.