Using different passwords for usual login and for admin-requiring actions
The way I achieve this is what you suggested:

Make a secondary Admin account and then take away your admin privileges.

I'm almost certain that it is the only way to achieve this.