We want call centre users to be able to reset a user password. The following are the requirements:

1) The user should only see the Administration -> Users in CMS Desk
2) Under Users only see the Users tab
3) For a selected user, only Password tab should be displayed

Experimenting with permissioning model, we have a role created with:

a) Read on CMS Administration module
b) Display module, Modify & Read on Users module

The above permissions is able to achieve the following:

1) The user can see the MyDesk & Administration -> Users in CMS Desk
2) Under Users object they can see the Users tab, Mass e-mail tab & On-line users tab
3) For a selected user, they can see General, Password, Settings, Roles, Departments, Notifications, Categories, Friends(with Access denied message), Subscriptions, Languages

Is there any way of achieving what is required? Or is it better to create a simple webpage that uses the API to reset user passwords?