How do I delegate control of the "Password Never Expires" account option?

We have delegated control to a limited group to reset passwords.  We ask them to check the "User must change password at next login" box.   Many of the accounts are set to never expire, and these options are mutually exlusive.  i realize we could use a script to remove that option, but we are not ready to roll that out yet.  We just want to delegate control to this limited group to also uncheck the "Password never expires" box so they can select the "User must change password at next login" box.  What AD attribute do we need to give access to?