Create a file e.g. in /etc/sysconfig with the env variables KEYCLOAK_ADMIN and KEYCLOAK_ADMIN_PASSWORD and their values (set the correct file permissions to secure it). Use this as EnvironmentFile in the systemd unit so the process sources it. After starting Keycloak the first time, you can delete the lines out of the file using lineinfile.
I am using the sysconfig file for the database parameter, too. So I don't have them in the configuration file, but using the environment variables.