I have a question about this.
Who is the intended audience for this secondary admin user? The end users who are being demoted to standard accounts, or for IT only?
If the concern is that end users would use this account to log into, you might want to instead look into something like a temp admin policy, a la MakeMeAdmin, or using a program like SAP Privileges.
If IT Security's goal is to lock out other IT people from logging into this account, then this is a false sense of security. Once you know the creds for a local admin account, being able to log into the account or not is inconsequential. I can do basically almost anything admin related with just the credentials and the Terminal application that I can do if actually logged into the account. So I'm not sure what they would be thinking they're preventing if this is the case. This is true of course if the account was intended for the end users of the devices. Logging into it is the least of the concerns once you know the username and password.
Either way, if they really need this, you can try changing the home directory path for the account from /Users/username to /usr/bin/false. From what I can see, this allows the account to be used in dialogs that require authentication, and can be logged into in Terminal, but when you try logging into the account at the macOS login screen, it hangs and never completes login. That's not ideal of course, so I'm not sure if causing the system to hang would be acceptable, but it does prevent logging into the account at the GUI from what I can see.
