Is there any reason to not do this?
Yes, I think of two reasons not to do it:
- The user may mistakenly enter in their full-access password into a compromised machine.
- Once a user enters their lower-access password into a compromised machine, now the attacker potentially knows a username and can try to brute-force the other password. This gives the attacker (some) more information than if they didn't know the username of a full-access account at all.
That being said, what you have proposed is probably better than changing nothing and having users login with full-access on potentially compromised machines.
Another thing worth considering is having multiple users with different permissions rather than multiple passwords for the same user. It's only slightly better in that users could still login with the wrong username, though this is probably a little less likely to happen compared to typing username-[tab]-password-[enter] muscle memory. It does solve problem #2 though, and it's also easier to manage a separate user if the account needs to be disabled or you want to track logins.
Other things to consider: not allowing full access users to login outside of a particular network/VPN, only allow full access logins on previously registered computers (with one-time 2FA), or requiring 2FA for every login for (at least) full-access users.
Perhaps the best solution is to never use untrusted machines. Have your users bring their own laptop and always use HTTPS. Or, they could even use their own mobile hotspot if the network cannot be trusted either.