Currently there is no user type that can alter checks, without being able to alter users. The customer admin user type is the only one that has permissions to change checks, but it can also alter users.
It would be nice if either the user permission was removed from customer admin, or if a new user type was introduced that only allows the user to alter checks.
Update: This was recently released. We have created a new user role (Check Admin) that have access to alter checks but not users.