Qemu supports delaying the boot with an option, but that option is in effect if and only if the boot menu is enabled.  Would it be OK to expose that option, knowing that the user can change the boot order in that case?

Patch proposed upstream:

https://www.redhat.com/archives/libvir-list/2014-August/msg01069.html

Fixed upstream with patches v1.2.7-221-g43b8123 to v1.2.7-223-gadfdb8d:

commit 43b8123d398361c1354804e0768f95163c69447f
Author: Martin Kletzander <mkletzan>
Date:   Fri Aug 22 13:39:26 2014 +0200

    docs, conf: add support for bootmenu timeout

commit 9e1af156af45d6e0b5525afc10ff59589081cc5a
Author: Martin Kletzander <mkletzan>
Date:   Fri Aug 22 13:42:46 2014 +0200

    qemu: add capability probing for splash-timeout

commit adfdb8d5bdec0799571c99ed5479d8798b3e3a96
Author: Martin Kletzander <mkletzan>
Date:   Fri Aug 22 14:13:37 2014 +0200

    qemu: add support for splash-timeout

Verify as below:

[root@localhost ~]# rpm -q libvirt qemu-kvm-rhev
libvirt-1.2.8-7.el7.x86_64
qemu-kvm-rhev-2.1.2-8.el7.x86_64

<1> Enable bootmenu, set timeout=3000
[root@localhost ~]# virsh dumpxml r7 | grep /os -B4
  <os>
    <type arch='x86_64' machine='pc-i440fx-rhel7.1.0'>hvm</type>
    <boot dev='hd'/>
    <bootmenu enable='yes' timeout='3000'/>
  </os>
[root@localhost ~]# virsh start r7
Domain r7 started

[root@localhost ~]# ps axu | grep qemu-kvm
qemu     31421 66.6  0.5 6510468 39444 ?       Sl   10:13   0:05 /usr/libexec/qemu-kvm -name r7 -S -machine pc-i440fx-rhel7.1.0,accel=kvm,usb=off -cpu SandyBridge -m 4096 -realtime mlock=off -smp 24,sockets=24,cores=1,threads=1 -uuid dab135b3-0a04-404f-9c5f-c7d266e5661e -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/r7.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard -no-hpet -no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot order=c,menu=on,splash-time=3000,strict=on ...

[In guest]
I monitored the guest bios, showing "Press F12 for boot menu." and waiting for 3 seconds.

<2> Disable bootmenu, set timeout=3000
[root@localhost ~]# virsh destroy r7
Domain r7 destroyed

[root@localhost ~]# virsh edit r7
Domain r7 XML configuration edited.

[root@localhost ~]# virsh dumpxml r7 | grep /os -B4
  <os>
    <type arch='x86_64' machine='pc-i440fx-rhel7.1.0'>hvm</type>
    <boot dev='hd'/>
    <bootmenu enable='no'/>
  </os>
[root@localhost ~]# virsh start r7
Domain r7 started

[root@localhost ~]# ps axu | grep qemu-kvm
qemu     31474  105  0.5 6510468 39448 ?       Sl   10:14   0:03 /usr/libexec/qemu-kvm -name r7 -S -machine pc-i440fx-rhel7.1.0,accel=kvm,usb=off -cpu SandyBridge -m 4096 -realtime mlock=off -smp 24,sockets=24,cores=1,threads=1 -uuid dab135b3-0a04-404f-9c5f-c7d266e5661e -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/r7.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard -no-hpet -no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot menu=off,strict=on ...

<3> Set a value is not in [0, 65535], such as -1 and 65536 in below steps
[root@localhost ~]# virsh edit r7
error: unsupported configuration: invalid value for boot menu timeout, must be in range [0,65535]
Failed. Try again? [y,n,f,?]:
error: unsupported configuration: invalid value for boot menu timeout, must be in range [0,65535]
Failed. Try again? [y,n,f,?]:


And tested the bug using qemu-kvm package, got same testing results. 
[root@ibm-x3650m3-07 ~]# rpm -q libvirt qemu-kvm
libvirt-1.2.8-7.el7.x86_64
qemu-kvm-1.5.3-78.el7.x86_64

We can get expected results, move to Verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0323.html