Disallow sudo command for specific user

For example we do not want user ana to change the password for root. In this case, the sudoers configuration will be:

ana ALL=/usr/bin/passwd,! /usr/bin/passwd root,/usr/sbin/useradd,/usr/sbin/usermod

This will allow user ana to change the password for all users, except the user root