This should work as you aren't using guest users. You should be using normal local accounts in ISE to authenticate non-AD VPN users.
Try this:
1) Configure local group in ISE, Allowed_VPN_Users
2) Configure local users in ISE and assign them to Alllowed_VPN_Users group.
3) Build a sponsor group, VPN_Password_Change, and strip away all of its rights to build any accounts.
4) Assign Allowed_VPN_Users to the sponsor group
5) Build sponsor portal, VPN_Password_Change, and strip everything out of it. You can even use Java script to hid buttons.
6) Assign FQDN so the sponsor portal to make it easily accessible, changemypassword.mycompany.com.
You could even make this accessible over the Internet, but that may be going too far. If you have never used the sponsor portal to change password it is a bit hidden. You need click in the upper right corner where it says "Welcome <username>". I have used this similar method when I was using the local database for TACACS admins.
I can't remember if the API support local user account password changes. I haven't explored that.
