You can possibly use PolicyKit rules to "unlock" libvirt for uids which are members of a specific gid-group. Here is another question, which does that for virt-manager (which like virsh console is based on libvirt).
Specific advice for "unlocking" virsh in this fashion:
Note that, as I understand things, using polkit like this will make all of libvirt (and thus all of virsh) unlocked to uids in the specified gid-group; you might not be able to prevent your guestVM owner from accessing other VMs through virsh and/or virt-manager, in other words.
Caveat: this answer probably allows you to get virsh console to work without a password prompt, but it also may allow other things to work (which you may not want). Insert the usual disclaimers here, about carefully testing your security after attempting any kinds of changes like these; you may be lowering your defenses more than you wanted to.