What am I doing wrong? I want to like M&M, but it seems very rule intense on both sides of the screen.
From the sound of your post you're saying "No" too much.
Elric's reply is good and should be very helpful.
More than most RPGs, superhero games require a social contract. Everyone has to agree on the genre, the types of characters, and to play a character that fits.
Once you get that agreement, most of the rest of it will fall into place. And the GM will be able to say "Yes" most of the time.
Regarding Hero Points: They are extremely powerful. I've actually limited Luck to 1, maximum, forcing my players to rely upon role-play awarded Hero Points to use them. As such, I can be generous while still having foes that can be meaningfully threatening (to better fit the tone of my campaign).
Heroic Feat has been the
least game-breaking option. The occasional Improved Critical just makes battles shorter. The Recovery Check option has probably been the one that has most screwed up my fun (and is the main reason I don't allow multiple Luck feats). I'll also note that the Power Stunt is an effect of
Extra Effort, not hero points, making it available to any character, regardless of how many Hero Points they may have. Bonus, the fatigue imposes a real cost that makes my players reluctant to use it.
And, finally, anything the players attempt must get GM approval. So, there's always the GM test, no matter what.
Regarding Mimic and Nemesis: both of these powers require a ton of work on the player's side. Any single use effectively rewrites entire sections of the character sheet. As such, I've strongly advised all my players to stay away from them, for their own fun and enjoyment.
I already stat up super-villain enemies fully, when I'm not using existing ones from the setting. As such, telling them what's available (and the rank it's at) is no stretch for me.
Using those enemies is just as much work for me as for the players. As such, I stay away from them for my own ease and enjoyment; I could run one, and probably will sometime soon, but mimics are too ill-defined to have a good theme and plot hooks. Also, a Mimic is only as powerful as what he's mimicking; if the only thing around is a geriatric security guard then he's not much of a threat.
Good luck.