redhat 8.6 on gcp - need to have control over boot process to have a password secured before full boot up

hello, i have a redhat instance in gcp. this instance needs to be cis benchmarked with level 1 and level 2 (later). to be benchmarked it has to be able to have a password on reboot. basically, i needs to prevent a reboot on coming up. on rebooting it should stop request a root login and an specific password (not root, but one that is set with grub2-setpassword hash). Can u pls tell me how can i achieve this. I have looked into the redhat knowledsge based, but even on doing the grub2-setpassword -. which creates the users.cfg, and making a grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg it does not stop the boot, and ends up with the regular console prompt. I do access the instance via console - console login . thank you for your help ./a/.