What we do is create two entitlements; one for users and one for administrators (including our service account).
We remove the Destroy action from the User entitlement and replace it with Custom Destroy. The vRO workflow initiated by the custom destroy will call the native Destroy using the service account (which is configured to run the vCACCAFE:Host connection) as it is still entitled to the native action.
Our use case wasn't the same as yours though. We actually needed to remove Destroy from machine components to stop people breaking multi-machine deployments. We swapped out Destroy for Cloud.Machine and Virtual.Machine with a custom action called Destroy Deployment that was just a wrapper for figuring out the root deployment resource and calling the native destroy for it. Users themselves were still entitled to Destroy at the deployment level.
As I mentioned in the other thread, you've really only got those three options.