When a user is part of an external user directory which is read only the ability to change the password in the profile section of the user should not be available. Not exactly sure how to disable this (grey the button, remove entirely) but as the directory is read only the change is not possible from the Confluence UI.

The 'Forgot Password' link on the login screen should also be made unavailable.