Hi Muhammad
I believe what is meant by "service account role" is basically a new role that you create and then assign it to an account. That account will then be used as a service account,
If you have another API user set up for HRIS system, you could create a different role for this new integration and a new account (that's usually how we manage multiple API integrations in our system). And then just go through permissions and add only relevant ones. I think when you add functions to a webservice, it should tell you which permissions are relevant (but that is not an complete list, usually others become evident when testing).