Possible to Pause Protection with password in place?

[slarkins 5]

I have all my endpoints set with password protection. To pause protection the password is required. I do not want to give my users the password to the endpoint. Is it possible to password protect all settings but give the end user the ability to pause protection without entering the password?

[Marcos 5,462]

I assume it could work after allowing override mode via a policy: