Permission to modify network connections on standalone ESXi

Hello,

we have to operate some standalone ESXi 4.1 hosts to which our customer has access too. We're trying to restrict the customer's permissions as far as we can.

Unfortunately, on some VMs he needs some extended rights.

How can we grant permission to modify the VM's network (change portgroup) not on all but some VMs?

All I've found is this:

VMware KB: Enabling the vCenter Server permissions required to modify virtual machine network settings

But this is about vCenter and requires permission assignment on the highest level.

Has anyone lese had to deal with an requirement like that?

Any help appreciated.

Thanks!