I had the same issue. A possible way to overcome this issue is making the administrator-directory of a certain slave site "password protected". By setting different passwords on different slave admin sites you make them available only to people how know that password. Drawback is that administrators have to login twice (first this password protection en then the Joomla-login).

It is NOT possible to provide different password to a same user when you share the users.
The password will be the same for all the websites.

In addition, you proposal to add a second password, is similar to add a "htaccess" password.
The problem is that this htaccess file should be "shared" for all the website also.
So you this will not work as the htaccess will be identical for all the websites.

JMS is NOT designed to provide sharing at record level.
It uses MySQL table sharing .

This is not a bug as this is documented like that.
I can just notice that in my whished list.

Was there ever an answer to this question?

I'd like to use both components, but without being sure of their compatibility, don't want to spend the money...

Any insight would be most appreciated.