Password policy settings can be found in this documentation https://docs.moodle.org/404/en/Site_security_settings#Password_policy this is where you can set some of these settings. Ideally for large systems using SSO and an external authentication method will give you more control
In addition to Brett's advice, for added security you could also set up Multi-factor authentication.