sidekick They must also be able to change their password via the webmail client
That is not possible. Mailcow UI can be used by users to reset their passwords, and - very important - set App passwords and temporary mail addresses.
App passwords are needed for the client software, because if you enable 2FA (which you always should), you cannot use your login password anymore for client configuration!
If you let the user logon to mailcows UI, they can open SOGo with just one click from the first UI page, without needing to log in into SOGo again.