Passwords are hard to remember. They're the biggest, nastiest gaping hole still going when it comes to securing systems. From a cognitive science perspective, having to have passwords at all is a security flaw. That said, we're stuck with them.

The obvious problems you mention are real. But they might not matter so much, depending upon your threat model. Some users will write down passwords. When the written password is stored as if it were money ("It controls where your paycheck gets sent, so take care of it like it's 10 $100 bills"), that prevents misuse by both remote adversaries and dishonest coworkers. That leaves memorizability for those who don't write it down. Almost all users, if allowed to select their new passwords, will choose something memorable over something random. But with adversaries now greatly preferring sniffing & keystroke logging to cracking stolen hashes, randomness is overrated. In my real world, I'd prefer users writing down their new passwords and treating them like money, or their choosing something memorable but not trivial, to their never changing them.

Frequent password changes actually don't need to train people to look at them like they do airport security theater. Most users will pay attention to a succinct statement of who & what they're helping us protect against as the motivation. (And it has to be succinct. They have their jobs to do, and not a lot of time to spend on you, no matter whether your play will win you a Tony award or not.) While that may still be theater (story telling), it's a good kind of security theater. It avoids spreading mistrust.

Attempting to co-op any remaining distrust/disbelief can be a good bit of theater as well. You can look at it as a variation of "good cop, bad cop," with the good cop's suggestions the minimum necessary. However, as your example for that you suggest, "one strong password that can be varied back and forth." Sadly, that doesn't protect against the very real threat of attackers who remember old passwords and retry them, often years later.

If I have to pick a bad cop, I'll still prefer external "forcing functions" like govt. regs or hostile auditors. But then, rather than suggesting something that makes the users vulnerable to external adversaries (a large chunk of our threat model), I'll suggest that they write the new password down and keep it safe in their wallet like it was 10 $100 bills. (But that's what I was suggesting anyway, without the bad cop. No Tony award for me!)

All that said, passwords aren't going to protect systems. As a round figure, 10% of users will do unwise & naive things with them. That means access control is 10% porous, and you need other prevention, detection and response measures in place to deal with that.