So I want my instance of the pallet membership to be managed only by a specific pallet, and not even the Root origin.
Is there anyway to create an EnsureOrigin object that can verify that a specific pallet dispatched the call ?
You can calculate the address of your pallet, and then easily compare with the origin address.
Check how to obtain the pallet address here Query AccountID of a pallet, here How can we get a Pallet's Sub-Account Address using PolkadotJS API and here How do i find the address of the treasury?