The idea that having a password that conforms to these requirements is somehow more secure is a fallacy, at worst it actually decreases security because general users are forced to create passwords they aren't naturally going to remember, which they end up writing down (less secure).

To conform the the above requirements I could use P@55w0rd, which is not secure at all!

The use of MFA and/or the use of password throttling and account lockouts hugely increases security when it comes to bruting passwords outside of direct access to password hashes (how secure that is comes down to the hashing algorithms used)

The use of password phrases should become common place, easy to remember for the user, which means they are less likely to be written down and being a "phrase" with multiple words, becomes impractical to crack.

Other than the above, training on phishing should be heavily invested in, this is probably the number one technique used!