I didn't actually understand what you want.
Hardened public keys cannot be generated from the master public key, and a priori cannot be attributed to the owner of the non-hardened addresses above.
There's no "hardened xpub (extended public key)" at all.
There are only "hardened childs" or "normal (non-hardened) childs", of one parent xprv (extended private key).
The normal childs are derived from the parent public key, while the hardened childs are derived from the parent private key, so that any hardened childs can only be derived with the knowledge of the parent xprv (which contains the parent private key and the parent chain code).
Currently, Bitcoin Core uses the hardened childs directly as keys of receiving/change addresses (receiving addresses would be m/0'/0'/0', m/0'/0'/1', m/0'/0'/2', ...etc).
As far as I know, Electrum currently doesn't support such "hardened address" option. However, this could be also achieved with other tools, like Ian Coleman's BIP39 tool.
Although @Abudussamad had already provided a straightforward method, I think his method is not standard-compliant, though.
If you just followed his guide, your receiving addresses would be derived through "weird" derivation paths, like m/1'/0/0, m/1'/0/1 ,m/1'/0/2, m/1'/0/3, ...etc, while your change addresses would be derived through m/1'/1/0, m/1'/1/1, m/1'/1/2, m/1'/1/3, ...etc.
See, your addresses will be actually derived at the depth of 3, while regular Electrum wallets derive their addresses at the depth of 2:
The receiving addresses would be m/0/0, m/0/1, m/0/2, ...etc, while the change addresses would be m/1/0, m/1/0, m/1/0, ...etc.
In my opinion, it's better to achieve this goal with the BIP39/44/49/84 standard scheme.
BIP44/49/84 provide separation among different "accounts". If the xpub of "account 0" has already been compromised, you can simply switch to "account 1", which does not have any observable linkage to the compromised "account 0", as long as the parent "coin" xprv (which derives all the "accounts" from 0 to 2^31) is still kept secret.
This is easy to do with a BIP39 mnemonic, although Electrum always shows warnings about it. After checking "Use BIP39 seed" in the option dialog, Electrum will show you three different address type options.
For example, if you chose the legacy address type, Electrum would automatically fill the derivation path with m/44'/0'/0'. The last 0' was the account index number, of the 1st account. You could change this number to other value, like m/44'/0'/1' or m/44'/0'/2', which corresponded to the 2nd or 3rd account respectively.
If you then chose to use the 3rd account (m/44'/0'/2'), your receiving addresses would be m/44'/0'/2'/0/0, m/44'/0'/2'/0/1, m/44'/0'/2'/0/2, m/44'/0'/2'/0/3, ...etc, while your change addresses would be m/44'/0'/2'/1/0, m/44'/0'/2'/1/1, m/44'/0'/2'/1/2, m/44'/0'/2'/1/3, ...etc.
