Using different passwords for usual login and for admin-requiring actions I use Mac OS X 10.9.3.

Background: I log into my profile very frequently (e.g. after closing lid) and often do it in public. Someone definetely should be able to see it, and no matter if I make it 10+ special symbols long or not. I presume this password to be known for anyone.

Also my Mavericks by default whenever I need to change system settings or so, asks the same password as I use for login. Which is known for anyone as I said before. So, I want to discontinue this vulnerability.

Question: What's the best way to set different passwords for significant actions and for logging in? What if I i.e. create second profile with administrative rights, then set rights of a user on my current profile and expect Mavericks to ask that newly-made admin's password every time I attempt to do something significant? Aren't there any more convenient ways to achieve my goal? Thanks in advance.
The way I achieve this is what you suggested:

Make a secondary Admin account and then take away your admin privileges.

I'm almost certain that it is the only way to achieve this.