With SBE, QlikView doesn't authenticate by itself, it uses the Active Directory instead, so the user and password the users are prompted are their own domain account names and passwords. If the user is able to change his domain account password, then the Accesspoint will ask for the new one. If I'm DOMAIN\mabaeyens with password 1234, then these are the credentials the Accesspoint is prompting for.
In another words, the user credentials in the domain will be the same they will be prompted when accessing Accesspoint.
If you are not using same user's credentials, and they have to authenticate with accounts DOMAIN\Username different than their session logon (in my case, say DOMAIN\qlikviewuser1 password abcd), then they will need to be able to change this user's (qlikviewuser1) password.
Hope that helps.