Executing an SP with least permissions

Question

I have a script that our Helpdesk executes to gather info about user roles in each database on a server. They used to have high privleges on the SQl server but we have been working to scale back their privleges to only what they need. Our department could
always run the script for them.  I though about putting the script in a stored procedure and giving them execute permissions to the stored proc, but they still need underlying permissions.  I have attempted impersonation but if I allow them to impersonate
'sa', then I think I'm just blowing a hole in the security.  Here's the script they/we run.
DECLARE @databaseItr int
DECLARE @databaseName varchar(50)
DECLARE @tempSQL nvarchar(4000)
CREATE TABLE #RoleUserTemp
databaseName varchar(50),
roleName sysname,
username sysname,
userSID varbinary(85)
CREATE TABLE #DatabaseTemp
databaseIndex int IDENTITY(1,1),
databaseName varchar(50)
INSERT INTO #RoleUserTemp (roleName, username, userSID)
EXEC dbo.sp_helpsrvrolemember
UPDATE #RoleUserTemp
SET databaseName = '<system>'
WHERE databaseName IS NULL
INSERT INTO #DatabaseTemp (databaseName)
SELECT name FROM master.dbo.sysdatabases
SET @databaseItr = @@ROWCOUNT
--Iterate through databases
WHILE @databaseItr > 0
BEGIN
 --Get database name from temp table
 SET @databaseName = (SELECT databaseName FROM #DatabaseTemp WHERE databaseIndex = @databaseItr)
 --Get role membership for each role in this database
 SET @tempSQL = 'INSERT INTO #RoleUserTemp (roleName, username, userSID)
 EXEC [' + @databaseName + '].dbo.sp_helprolemember'
 EXEC sp_executesql @tempSQL
 --Set database name
 UPDATE #RoleUserTemp
 SET databaseName = @databaseName
 WHERE databaseName IS NULL
 SET @databaseItr = @databaseItr - 1
END
SELECT databaseName, roleName, username FROM #RoleUserTemp
DROP TABLE #DatabaseTemp
DROP TABLE #RoleUserTemp
Maybe there is a better way to get the info or maybe we should just run it for them.

Answer 1

I changed the server Role query and insert into the temp table as follows. 
INSERT INTO #RoleUserTemp (roleName, username)
SELECT SP1.name AS ServerRoleName,
 isnull (SP2.name, 'No members') AS LoginName  --SP2.name AS LoginName
 FROM sys.server_role_members AS SRM
 RIGHT OUTER JOIN sys.server_principals AS SP1
   ON SRM.role_principal_id = SP1.principal_id
 LEFT OUTER JOIN sys.server_principals AS SP2
   ON SRM.member_principal_id = SP2.principal_id
 WHERE SP1.is_fixed_role = 1 -- Remove for SQL Server 2008
 ORDER BY SP1.name;
I think this gets that part correct because when I query the temp table, I see the same results as when I run my old stored proc except it includes roles with no members.
I've changed the Database role section of the script to this:
INSERT INTO #DatabaseTemp (databaseName)
SELECT name FROM master.dbo.sysdatabases
SET @databaseItr = @@ROWCOUNT
--Iterate through databases
WHILE @databaseItr > 0
BEGIN
 --Get database name from temp table
 SET @databaseName = (SELECT databaseName FROM #DatabaseTemp WHERE databaseIndex = @databaseItr)
 --Get role membership for each role in this database
 SET @tempSQL = 'INSERT INTO #RoleUserTemp (roleName, username)
  SELECT DP1.name AS DatabaseRoleName,
  isnull (DP2.name, 'No members') AS DatabaseUserName
  FROM sys.database_role_members AS DRM
  RIGHT OUTER JOIN sys.database_principals AS DP1
  ON DRM.role_principal_id = DP1.principal_id
  LEFT OUTER JOIN sys.database_principals AS DP2
  ON DRM.member_principal_id = DP2.principal_id
  WHERE DP1.is_fixed_role = 1
  ORDER BY DP1.name'
 USE @DatabaseName
 EXEC sp_executesql @tempSQL
 --Set database name
 UPDATE #RoleUserTemp
 SET databaseName = @databaseName
 WHERE databaseName IS NULL
 SET @databaseItr = @databaseItr - 1
END
My line USE @DatabaseName is not correct though and I'm not sure what to change it to.  Also, then, the script calls another stored proc 'sp_executesql'.  Will that work or do I need to rework how the insert and select statement are invoked?