Granting service control manager access permission to user outside of administrator group
Try the sc.exe with sdset command. It uses sddl format and I'm not sure if you can implement your needs exactly as you want. See the article Understanding the SDDL permissions in the ACE_String to convert to sddl format.