Passwords are the great conflict with authenticated users and security, there are many regurgitated 'best practices' that often lack though on the actual outcome to both user experience and the level of security gained. Forced password changes are one of these.
Your PO wnat's to optimmise secuirty above user experience and being a commerical entity this is probably the right approach, within reason. However the required specifications for a secure password compared to the ability for average users to create passwords that meet that specification and retain a level of usability is the issue that faces security. So in forcing user to change passwords you gamble with the risk the new password is not secure but meet those standards. This is a growing and rational opinon of security organsiations worldwide. https://www.cesg.gov.uk/articles/problems-forcing-regular-password-expiry
If you force users to create new paswords immediately you greatly tip the balance of poorly created passwords. For example if you change your policy from 8 chars to 12 (which is good, if you already include alphanumeric and specific special chars) which immeditately will make most user accounts in breech of this policy. So if userA changes their password from 'passw0rd!' to passw0rd!"£$ does this enforce a greater level of security? No it doesn't, humans use patterns, to identify and remember everything, the simpler the pattern the easier it is to remember. So giving user spot test to create strong passwords on the spot will weaken security not strengthen it.
The other factor to include in discussions is that security breaches using individual accounts is usually reserved to admin accounts as these will be targeted due to their elevated access permissions, most general user accounts are obtain through obtain DB tables or hash files which are decrypted in bulk, so how secure are admin accounts and how easy is to access the applicaiton, it appears to be on an internal network so is the likely hood of bulk account access less likely?
As it's an enterprise application I would suggest that authentication should be handled by AD or another SSO or PKI environment, this makes it the best user experience as the user is not directly involved in authentication and security is as high as it can be.