Allowed to Edit Address Book but not their Site User Profile

In our highly regulated business environment, we share data via API and users can not change their profile information  BUT should be able to update address book. As the site user permissions are set today you have to toggle the EDIT USER to get access to change anything in your address book.  These users want the ability to ship to their office, their home and potentially a customer.