You can use the following CL command in a program, menu or create your own command:
chgusrprf ??usrprf() ??password()
When the command runs, it will only allow them to change those 2 parms. However, if they have access to a command line, they can always type the command in and prompt it. In that case this would not help you.
You could create your own CHGUSRPRF command as above and add it to a lib above QSYS. Then revoke authority to the IBM command for all except those you want to have access.