Register system without storing the password locally

I want to automate instance creation, part of which is registration with our local satellite 6.3 server. Instances are currently 7.6, though that's likely to change in the next few weeks. The IDM server is slaved off of AD.

Is there a way to register without storing the administrative password locally? That's against policy and probably a bad idea as well.

I've tried subscription-manager, bootstrap.py and hammer, and I can't seem to find a way to do so. Properly we'd be able to authenticate using keys, but that doesn't seem to be an option.