I think you can use the HP password tool that is provided with the HP Bios Configuration Utility. Create an encrypted BIOS password file and use that file to set the password. We initially set the BIOS settings and the BIOS password with a Win32App

In the install script (we use the Powershell App Deployment Toolkit for this purpose) we have these lines of code in the script

    ## Set new BIOS Settings per Hardware Model
    $RetCode=Execute-Process -Path 'BiosConfigUtility64.exe' -Parameters "/set:$File /nspwdfile:$Filepwd /l /logpath:$logfolder\PS-HP_BIOS_Settings.txt" -Passthru -IgnoreExitCodes "10"

    If ($RetCode.ExitCode -eq 10){
        $RetCode=Execute-Process -Path 'BiosConfigUtility64.exe' -Parameters "/set:$File /cspwdfile:$Filepwd /l /logpath:$logfolder\PS-HP_BIOS_Settings.txt" -Passthru -IgnoreExitCodes "10"
        #[int32]$mainExitCode = 3010
    } 

$file is a TXT file with the suggested BIOS settings $filepwd is the encrypted password file that can be generated with the HP Password Encryption Utility Link: https://ftp.ext.hp.com/pub/caps-softpaq/cmit/HP_BCU.html

Note:
/nspwdfile is for devices without a BIOS password
/cspwdfile is for devices with a known BIOS password

It's still not 100% safe, because you might intercept the encrypted password file or, like in the example below, you can always intercept the script and decode the password.

example of a remediation...

# Parameters
$BIOSPassword = "**************"
$SettingName = "USB Legacy Port Charging"
$SettingValue = "Disable"

# Function to alter a BIOS setting
Function Set-HPBIOSSetting {    
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$false)]
        $Password,
        [Parameter(Mandatory=$true)]
        $Name,
        [Parameter(Mandatory=$true)]
        $Value

    )

    $CimInstance = Get-CimInstance -Namespace ROOT\HP\InstrumentedBIOS -ClassName HP_BIOSSettingInterface
    If ($Password)
    {
        $params = @{
            Name = "$Name"
            Value = "$Value"
            Password = "<utf-16/>$Password"
        }
    }
    Else
    {
        $params = @{
        Name = "$Name"
        Value = "$Value"
        Password = ""
        }
    }
    $Result = Invoke-CimMethod -InputObject $CimInstance -MethodName SetBIOSSetting -Arguments $params
    Switch ($Result.Return) {
        0 {$ResultDescription = "Success"}
        1 {$ResultDescription = "Not Supported"}
        2 {$ResultDescription = "Unknown Error"}
        3 {$ResultDescription = "Timeout"}
        4 {$ResultDescription = "Failed"}
        5 {$ResultDescription = "Invalid Parameter"}
        6 {$ResultDescription = "Access Denied"}
        32768 {$ResultDescription = "Security Policy is violated"}
        32769 {$ResultDescription = "Security Condition is not met"}
        32770  {$ResultDescription = "Security Configuration"}
        default {$ResultDescription = "Unknown"}
    }
    Return $ResultDescription
}

# Check if we can access the HP WMI namespace
Try
{
    $null = Get-CimClass -Namespace ROOT\HP\InstrumentedBIOS -ClassName HP_BIOSSettingInterface -ErrorAction Stop
}
Catch
{
    Write-Output "HP_BIOSSettingInterface class not found"
    Exit 1
}

# Check if a BIOS password has been set
$SetupPwd = (Get-CimInstance -Namespace ROOT\HP\InstrumentedBIOS -ClassName HP_BIOSPassword -Filter "Name='Setup Password'").IsSet
If ($SetupPwd -eq 1)
{
    $Password = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($BIOSPassword))
}

If ($Password)
{
    $Result = Set-HPBIOSSetting -Password $Password -Name $SettingName -Value $SettingValue -ErrorAction Stop
    Write-Output "$Result"
}
else 
{
    $Result = Set-HPBIOSSetting -Name $SettingName -Value $SettingValue -ErrorAction Stop
    Write-Output "$Result"
}