Hi - anyway to prevent an Azure AD cloud only user from changing their password - like you could do on-prem?
Not that's not possible, might not help but you could change the expiry threshold to its maximum value 730 days:
Set the password expiration policy for your organization
Disabling Azure Active Directory Password Expiration
The second link says you might actually be able to increase it to 1,000 days with PowerShell.
Yes there is a way.
Here it is: https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_manage/disable-password-ch...