Passcode can be configured not to change and accounts ,, Screen time can prevent a few things also
Our Ipads have a Passcode to unlock and then for Screentime a Passcode only known by IT
You can also set a PassCode Policy Via Meraki MDM Profile settings