So I might need to implement a radius server, but I fear the additional work and the learning curve...
Huh? No, if you have a little time, then you just need to wait for the next release, which will allow local captive portal users to change their password, without involving a RADIUS server.