To be able to configure the user risk policy, I see that you need a P2 license. Is it possible for just the Admins to be assigned a P2 license and configure the risk policy and the remainder of the users in the tenant stay with a AD Basic license?
Possible, yes. Against the license agreement, yes. But as with any other license related questions, you should address this directly with your Microsoft TAM or local licensing folks.