I accustomed to create a dedicated admin-level Domain user account, on which backup processes are running, then blocking it's login ability on station, but I always thought it's a security risk.
Anyone can suggest a better practice how to do it?
You could add the user to the Backup Operators group, rather than Administrators. This grants the user the Read access to files and folders it needs to back up, but without the elevated privileges given to an Administrator. It's probably worth keeping the user prevented from logging on to workstations to prevent it accessing files for any purpose other than backups.