Is there any way other than the "user may update/override" to prevent some users from updating a validation list? I'd like to be able to allow certain users to update validation lists but not others, via password if possible.

Yes, one of the options when defining a password is:

x User May Edit Validation, Substitution Lists

If this check box is unchecked for a password, users opening the textbase with that password also cannot Accept & Update List -- the button is disabled.

This option applies to all lists in the textbase. There's no way to permit some users to edit/update some lists but not edit/update other lists, if all of the lists can be updated.