Basic Admin Role - HELP!

Summary

Basic Admin Role - HELP!

Content

I need a role with very limited permissions for our IT help desk employees to be able to reset USER and EMPLOYEE passwords, and view usernames and that is all. However, I was informed by Oracle Support that only a sub-admin of the main Administrator role is able to reset USER passwords. We tried to strip down all of the page layouts and list views as best as possible. However, there are still a few things this account can do that I don't want them to have access to, such as delete records, add new records, import employees/users, edit user roles and assign user roles to users, and change user/employee email templates.