First, the "second" password is actually a passphrase:
https://winscp.net/eng/docs/ui_authenticate#private_key_passphrase
Where do you see it being prompted for as a "password"?

Second, the actual "password" is not mandatory. If you do not want/need to use it, just do not fill it.

WinSCP version 6.3.3 requires two passwords, both called just "passwords", for SFTP connection.

The first is next to the Username, so I assume it's the user's OS password.

The second is in the authentication section, It is prompted for separately, and I think it means the private key passphrase.

Am I correct so far?

Well, the problem is that I don't want to give the OS password, for improved security. In fact, for the root user, my OS (Alma Linux/Webuzo) allows the user password to be forbidden for SSH connection.

But I can't see how to implement just the IP, username, private .ppk file, and private key passphrase as my credentials for WinSCP. What, exactly, do I enter into a WinSCP site specification to get this result?

I've been confused about this for several weeks now. The documentation doesn't resolve my confusion.

(Sorry, I don't see how a log file would help me understand what to enter in the site specification.)