By default, all users can change their Windows password: but you can prevent a user from changing their password, as a "Local Users and Groups" policy - you'll need the administrator's password to access that functionality. Once you've disabled changing password, only the administrator (or anyone who knows the admin password) can then change these users' password! I'm using Windows 7 in this tutorial, but the steps are the same for Windows 10.
Open the start menu: type lusrmgr.msc in the search field, and hit the Ctrl+Shift+Enter keyboard shortcut (to run the program as administrator).
Double-click on Users to show them, and double-click on the user you want.
In the User Properties popup, check the "User cannot change password" checkbox. Notice that you can access other policies, like forcing the password to expire (by unchecking Password never expires!) Click OK to save.
From now on, that user won't be able to change his or her password. When I disabled that functionality to write this tutorial, and went to the Control Panel to change my Windows password the usual way, I got a "Windows cannot change the password" error message. That's what your users will get if they try!
Bonus Tip: while the user can't change his/her password, any Windows admin user can do it. From the Control Panel's "User Accounts" screen, click on the Manage another account link, and enter the administrator's password. You can then double-click on a username to change their password. And yes, you can restore that ability to users at any point: just follow the steps above!