Set account expires in provisioning

Hello,

I have Administration Policy for provisioning users, I want to limit the users to 365 days (expiration date) as a default.

and if the Help Desk (who opens the user) wants to change it to less than a year they will have the ability -  but again only for 1 year at maximum.

How can I do it? Thanks!