You start with giving the papacy some provinces, depending on how fast you want to expand it makes sense to choose a border province for everlasting peace there. I assume you have the relations with the pope at perfect anyway (with multiple 500 florins gifts for example) and an alliance with him.

Once PapalStates has more than one province the pope starts to leave Rome on occasion instead of just sitting there. As the AI does not build enough happiness buildings and Rome grows pretty fast 4 spies will be enough to eventually make it rebel. If you can infect Rome with the plague when it riots it will help too. Then all you must do is siege the city in the same turn (keep a fully manned fort at the border for example) and voila Rome is yours. The next turn the pope will ask you to give it back but if you decide otherwise you will only loose one cross papa favour which you can gain back with 500 florins and Rome is yours forever. The papal favour seems to go down a tad faster now in my campaign but a few gifts now and then keep the pope happy.