You can’t remove a part of Exchange Organization role’s privleges. You can only remove someone from that role and assign them to a role with fewer priveleges. If they need privleges only found as an organization admin then they will have all privleges assigned to that role. Privleges are role based, not user based. Assign them to the role with the fewest privleges necessary to do their job, and if that is not possible and you do not want them to have this access remove them from the role altogether. I would talk with the person and tell them what you expect and if you have no trust then put someone else in that position you do trust to do the job the way you want it done.