At a former workplace we used a domain account called email.admin which as top-level access to all email accounts from a single server (user cannot log-on anywhere else).
create your user, add member groups etc and then on a DC:
Start Active Directory Users and Computers.
On the View menu, ensure that the Advanced Features check box is selected.
Double-click the user whose mailbox you want to give permissions to.
On the Exchange Advanced tab, click Mailbox Rights.
Click Add, click the user or group who you want to have access to this mailbox, and then click OK.
Be sure that the user or group is selected in the Name box. In the Permissions list, click Allow next to Full Access, and then click OK.
this is how i've set up the kind of access you want previously.
