AD Group Policy

Greetings all.

I am currently staffing my help desk. We have three support Tier 1 reps and two Tier 3 Reps. I will be bringing on more Tier 1 reps and Tier 2 reps.

In the future I should have:

5 Tier 1 Reps
2 Tier 2 Reps
2 Tier 3 Reps

I will be delegating some AD control to the Tier 2 Reps to assist with general AD maintenance and support, specifically changing domain user accounts.

My question is in regard to Group Policies. Currently right now I have service accounts and user accounts in the same OU in AD.

What I plan to do is create the following OUs:

Service Accounts
Management
Users

What I want to implement is to give the Tier2 reps access to change passwords for the Users OU only. Tier2 reps should not have access to Management and Service Account OUs. So if you could give me some tips on where to begin I would be very greatful. I don't mind doing research I just need a starting point.

I have a test domain that I can run tests against before rolling this out into production.

Thank you for any assistance.