This is currently not possible within IAM. If you feel this could benefit other developers feel free to create an idea for this. 

I'm sure there is ways around granting db_owner in order to run external scripts. Especially anything coming from the ‘outside world’, should be running with minimal privileges.

Sure, you could grant permission to run external scripts, but as far as I know, it's not possible through IAM.

The easiest workaround would probably be to rebuild this using a process flow or system flow. This way, only the indicium user would need the appropriate database rights.