The only option for a least privilege approach is by using vCenter otherwise it is root privileges on standalone ESXi and then you will have to monitor logs.
