Unfortunately the only option we have found is to deploy a second native email profile on iOS. We do have it set up where it is a profile deployed by via the self service portal, so technically the owner of the password can log in and do this without sharing the password to the admin. WS1 has problems with managing the exchange gatekeeping when working with two accounts on one device, so it ends up being a very manual process. It also creates problems with compliance that result in other manual processes.
I feel very similar to Myles: ' Hard to maintain, and not very secure. I've subscribed to this post as I would also like to know what people are doing about this need.'
I talked with support extensively about this last year and they said that this is a feature that is supposed to come to boxer late last year, but it is not there yet(as far as I know).