You can add additional password complexity/requirement logic with a custom plugin/module by listening to the EVENT_BEFORE_VALIDATE on the User class.
There is an example of that for Craft 3 here: https://craftcms.stackexchange.com/a/12166/57
I've used ...
AFAIK, there’s no current first-party policy enforcements, but there is this plugin we’ve used in the past to make sure passwords aren’t easily guessed or previously pwned. I would give it a go in the meantime.