custom security role

Summary:

I need to create a role that will allow users to:

Assign/unassign Data Access in manage data access for users

Unlock/lock accounts in security console

Update email addresses in security console

I have identified how to achieve the first two requirements but I am struggling with restricting the access to be able to update only the email address, the user should not be able to assign roles but providing edit user account is allowing this. Does anyone have any tips on how to restrict it to only allowing an update to the email address?

Content (please ensure you mask any confidential information):