There used to be a desktop client... I think it was the Cisco Desktop Agent or something like that. It talked to the ACS server to allow password change stuff.
But that was years ago and needed routing between the ACS and the client. So wouldnt work with a VPN.
I'd say not. TACACS+ shell login is the only application for acs password change these days.