m-law
The only way without modifying the code would be to create/Transfer a Ticket or two for each User in/to a Department all Agents don’t have access to. An Agent simply cannot delete a User that has Tickets the Agent cannot delete. Since you can only delete Tickets you have Department access to your Agents wouldn’t be able to delete all the Users Tickets ergo wouldn’t be able to delete the User.
The caveat is that if an Agent attempts to delete such a User the system will go through and delete all Tickets up until it hits the Ticket(s) it can’t delete. So in order to prevent them from deleting the user and all their Tickets you must transfer all their Tickets to a Department no one has access to.
Cheers.