Services Accounts
The minimum granular permissions that you need to delegate this task is:
Reset Password
Read pwdLastSet
Write pwdLastSet
You should create a new security group, delegate these permissions to it using the Delegation Wizard, and then add the service account to the new group.