Very good point. You should also consider implementing chroot to limit what the users that login into your network can do and access. If all they do is change their passwords you should be able to limit them to just that command. I would have to check to see if passwd can be done from a chrooted environment.
If that's all you need, you don't even need to give them a real shell. Just make their shell the passwd command with chsh. You could also create a secure web page for that.
