Hmmm, you can't do that specifically within ACS. You can add an admin user under the Administration Control section, and you can certainly stop them from doing most things within ACS simply by not checking the appropriate check-boxes in the Administrator Privileges section. What you can't do is allow them to only change the password for a user, once they can add/edit a user they can change pretty much anything under that user.
You can limit the options that appear under a user profile though, by going under Interface Config - Advanced Options, and unchecking all the per-user attributes. Then under the admin privileges only check the "Add/Edit users in these groups" checkbox and that way they'll only be able to change the user permissions, not the group. By limiting what actually appears under the user you effectively limit what the admin can change.
