Can user with role "realm-admin" be restricted to not be able to reset password for a specific user?

Getting advice
1

I’m trying to restrict a user, User1, who has the realm-admin role, from being able to reset the password of another specific user, User2.

I was able to achieve this restriction using the Fine-Grained Admin Permissions (FGAP) feature by creating the appropriate permissions and policies. However, this only works if I remove the realm-admin role from User1 and instead assign the following sub-roles explicitly by removing manage-users role:

  1. view-users
  2. impersonation
  3. manage-authorization
  4. query-users
  5. view-realm
  6. query-clients
  7. view-events
  8. manage-identity-providers
  9. query-groups
  10. view-clients
  11. view-identity-providers
  12. manage-realm
  13. query-realms
  14. view-authorization
  15. manage-events
  16. manage-clients
  17. create-client

It appears that if manage-users is assigned to User1, it bypasses FGAP with “manage“ scope on “User“ resource, allowing them to reset passwords regardless of the policies in place.

Is this expected behavior?
What would be the recommended approach to restrict a user with the realm-admin role from resetting the password of a specific user like User2?