Hi,
You can't use a password or other mechanism that allows the user to change the AnyConnect configuration, as it is stored in the AnyConnect XML profile.
If you want a group of users, with Always on VPN enabled, to be able to still access network/internet resources if the VPN gateway is not reachable for whatever reason (so AnyConnect fails to connect), configure AnyConnect "Connect Failure Policy" to open. This will allow those users to work as like "Always on VPN" is disabled, but AnyConnect continuously tries to establish the VPN connection.
Regards,
Cristian Matei.