Perhaps you can remove the cancel and close form buttons and make the form a blocking pop up, that would prevent users from moving forward if the password is not changed.
Remove your cancel button and set your save button as close button. That way one can never leave the form if validations prevent the save button from executing.
You should consider logging the user out with a java-action, see this link: https://forum.mendix.com/questions/1933/How%20would%20i%20logout%20of%20mendix%20via%20a%20microflow
The form is already 'blocking' With close button I mean de 'X' on the topright corner of the form. As far as I know, I can't remove that.