It’s possible to enable a “superuser” account in order to limit what can be done during boot time. When prompted the user name is “root”.
In order to allow it to work a secure password is required. Inside configuration is required to copy the output of the grub-mkpasswd-pbkdf2 program but only the part that starts with “grub.pbkdf2.sha512” until the end.
Once the superuser is enabled and password hash is correctly inserted the GRUB console access will be restricted and further permission restriction on various capabilities can be applied.
There’s no way to change or recover the password without tampering with the Libreboot firmware. Keep that in mind.