grant access to recruiting center for candidate access only

Summary: Our Taleo implementation pre-dates our entire support team and we are trying to figure out how to grant access to our help desk team to candidates within the recruiting center. We've already granted smart org access for user accounts, but not all candidate accounts make it to an actual "user" account so they aren't able to reset their passwords. I'm trying to figure out the best way to get them access to candidate data without opening up all the sensitive requisition data to that help desk team (we are ok if they can view, but we definitely don't