sed - matching pattern one but not pattern two

All,

I have the following file:

#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords. The default is pam_unix2 in combination
# with pam_pwcheck.
# The "nullok" option allows users to change an empty password, else
# empty passwords are treated as locked accounts.
#
# To enable Blowfish or MD5 passwords, you should edit
# /etc/default/passwd.
#
# Alternate strength checking for passwords should be configured
# in /etc/security/pam_pwcheck.conf.
#
# pam_make can be used to rebuild NIS maps after password change.
#
password required pam_passwdqc.so retry=5 ask_oldauthok min=disabled,8,8,8,8 passphrase=0 random=0 force=everyone
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_authtok
#password required pam_make.so /var/yp
--------------------------------------------------------------------

What I would like to do is generate a sed command that will:
Add "use_first_pass" to a line if the line contains "pam_unix2.so" but the line does *not* contain "use_first_pass".
The remainer of the file should be left alone.

I can generate the logic with:
a regex of:
(.*pam_unix2\.so.) (?!.*use_first_pass.)

I am having trouble translating that into a sed expression.

Thanks,
-Robert

If awk is allowed:

awk '/pam_unix2.so/ && !/use_first_pass/{$0=$0 FS "use_first_pass"}1' file

if you can use Python

for line in open("file"):
    line=line.strip()
    if "pam_unix2.so" in line and not "use_first_pass" in line:
        print "use_first_pass "  + line
    else:
        print line

or inplace version

import fileinput
for line in fileinput.FileInput("file",inplace=1):
    line=line.strip()
    if "pam_unix2.so" in line and not "use_first_pass" in line:
        print "use_first_pass "  + line
    else:
        print line