Netbackup Appliance 5230 and Activity Monitor Access

We have a Netbackup Appliance 5230 running 2.6.0.2 as a master server.  We would like to give our operators access to the Activity Monitor by setting up user accounts and plan on using auth.conf to restrict certain things.  My question is do you guys normally create an account on the appliance and do you set restricted shell?(rbash)  We don't want the operators moving around directly on the appliance.  Also we need to give the operators the ability to change their own password.  Thanks.