On my Synology Diskstation running DSM 6 only admin users can ssh in consistently (non-admin users have shell as /sbin/nologin in /etc/passwd -- you can set this to /bin/sh to temporarily allow ssh, but on reboot the /etc/passwd file is reset). For this reason some kind of sudo restriction is needed for an account which otherwise exists only to execute e.g. /sbin/poweroff. The following lines in /etc/sudoers worked for me:
# Allow guestx user to remote poweroff
guestx ALL=(ALL) !ALL
guestx ALL=NOPASSWD: /sbin/poweroff
Translation: disallow all commands, then allow only the desired command (without asking for password in this case).
With this configuration sudo asks for the password and then fails for commands other than the whitelisted one:
guestx@ds:~$ sudo su -
Sorry, user guestx is not allowed to execute '/bin/su -' as root on ds.