The two-form invitation workflow below does not, by itself, prevent a new user from logging in before changing their PIN. To require setup before login, also configure Conditional Login using a field that records whether setup is complete. Test both incomplete and completed users. For the invitation workflow, create 2 forms:
Create a dedicated form for updating the pin fields, and use the edit record formula to add it to Airtable. You can also set the form to redirect to the portal after form submission, and use a checkbox to allow it to be used only once.
Create a separate form for creating user records, which can be used by admins. Enable the submission email feature for this form, which will send an email to the created user containing a link to update their pin.