Writing a Script for a Printer

Im not seeing anything in the cupsctl man page. Im thinking this may be a preference through the printer driver. I may suggest that you use compose to index the system, install the printer the way you want, then create a snapshot afterwards. This may clue you into what plist is needed to make the change, are you can then create a separate DMG to push down in addition to your policy to make this change.

You may want to try the lpadmin command to add the printer and set the defaults the way you want. You can see all the options for the printer by using "lpoptions -p test -l" where test is the name of the device. A command like:
lpadmin -p "test" -v "lpd://192.168.0.1/" -D "Test HP Color LaserJet Enterprise M651" -L "Administration" -P "/Library/Printers/PPDs/Contents/Resources/HP Color LaserJet M651.gz" -E -o printer-is-shared=false -o HPJobRetentionOption=HPJobRetentionPersonal -o HPUsePINToPrint=True -o HPPinToPrint=Custom.1234
would create a new printer with a device name of test using the lpr protocol to IP address 192.168.0.1 with a printer name of Test HP Color LaserJet Enterprise M651 with a location of Administration with Job Storage mode set to Personal using the default system user name and default job name with a pin-to-print code of 1234. Now I don't have this model printer to test the command out on but I think it should be correct. This would only allow you to set the passcode to one code, but the end user could change it themselves through the GUI. I hope this helps.

There is some good information over at https://jamfnation.jamfsoftware.com/discussion.html?id=6885 especially the guide located at http://techjournal.318.com/mass-deployments/configure-network-printers-via-command-line-on-macs/