Shared subset of users in a multi-site instance
As you mentioned yourself you can share users across multiple site but that are all users. So you need an external 'database' for your admin users that magically exists for all sites.

For this you could use https://www.drupal.org/project/ldap which could contain you administrators.

Normal users can login as normal aka without use the LDAP directory.

Note LDAP can work with MS Active Directory too.