In many administrations LDAP or Keycloack have become a "must", but if external authentication is not an option, you can override the "passwordGenerator" bean for automatic password generation (when you invite an external user to the site for example), with your java class and then set a behavior listening on the update of the "usr:password" property to avoid weak password updates that do not meet your requirement (not tested).
