I really think you need a bit of scripting to do this. You could make it straightforward, by putting a special file in the users home directory, when the account is created e.g. .firsttime - then use this as a flag as to whether the user has logged in.
Then in the system-wide login profile, you test for the existence of the file, if its there, you could then touch a file in a root-owned directory with sticky-bit set and no execute (this would be to prevent users from seeing the file), and then remove the original file.
three lines of script added to /etc/profile.d
if [ -e ~/.firsttime ]
then a cron script, or manual script could set expire on the accounts listed. I would put a check in to make sure the ownership and filename match, to prevent someone from putting a "root" file there.