The answer from jasonwryan is going to be the right way to make this change. The only addition I would make is that you could set the match to be group based so that any users in the wheel group would be required to use key authentication while others could use passwords.
I know you want to do this without changing the system config files, but there is a good reason why that will not be possible. In your head it makes sense that your user should be able to institute a more secure login policy, but just because in your mind it is a more secure option doesn't change the fact that it is still a change to the system login requirements for a remote user.
To understand why this is a problem, imagine the scenario the other way around. The system administrator (who can change the system config files) sets the system to key based login only. Then, some user comes along and with only access to their own user file and sets their account to allow password authentication, overriding the system policy. BEEEEEEP. Security problem!
Does that explain why the kind of change you want to make is only possible from the system config file?