O365 password admins can do more then just change passwords

Recently we have had an issue where one of the IT staff designated "password admin" in office 365 was using the access granted to them to start reading the subject of email people were sending..Which brought up the conversation that hey password admins can do alot of things..., including message traces in the exchange admin portal, they can look at the Azure portal and add guest users to the system...

Is there any way to configure password admins (or create a new role) in the office 365 portal that let them only to do one thing, which is reset the password of a in-cloud user if need be?