Specific Permissions to Allow Helpdesk Analysts to Perform an Alter User with OEM 10g?

We would like to have our helpdesk analysts be able to use OEM 10g to perform 'alter user' against specified users.  We have helpdesk analyst user ids set up with this capability & they appear to work as intended.  However, I would like to tighten up the permissions on these accounts, they  are defined as follows:

GRANT ALTER USER TO "HELPDESK_ANALYST"
GRANT CREATE SESSION TO "HELPDESK_ANALYST"
GRANT SELECT ANY DICTIONARY TO "HELPDESK_ANALYST"

Straightforward enough.  However, I would prefer not to use the 'select any dictionary' system privilege & specify specific tables needing access to.   I've found Metalink discussions on this topic for 9i OEM, but not 10g.