How to change password via REST when validating email address (first login link)
I'm not sure there is a pure Drupal core way of doing this, but there are contrib modules which can help. These modules involve resetting the password when it has been forgotten but may help with understanding the process.

Password reset REST allows resetting the password via REST. 


  Small module to help with resetting password through rest.
  
  This attempts to provide the same logic present with a
  pass-reset-token as you'd do with the normal interface.


REST Password Request provides an alternative method which involves generating a temporary password so the user can change their password via rest, and then log in as normal.

REST Register User with Email Verification supports email validation, but may not be exactly what you're after.

It is also worth reviewing this issue regarding anonymous REST and user entities: A REST resource's "auth" configuration MUST be non-empty, which prevents configuring it for anon access only