How to allow our support people to reply to user’s comments but not publish extensions?

I can’t find a way to grant our support people permissions to reply to user’s comments without also granting them rights to publish new versions of the extension, which is a serious security hazard.

Best I could find was to transfer the app to a group, make the support people members of that group, and NOT pay the $5 developer registration fee for them. No need to say that it’s a very weak solution.