A user with role which does not have read to "Search" app could not access "Account Settings" to change his password. Any idea how to get "Account Settings" without Search app grants? TIA.
Those settings are part of the default Splunk UI, aka the Search app. Don't take it away, it's only causing you trouble.
Side note, don't use local Splunk accounts, use LDAP. Then users don't need to keep an additional password inside Splunk.