How to revoke "Alter role" on users
The only way other users have the ability to change the password of the SA account are other members of the sysdamin role and members of the security admin role. Are your users part of the sysadmin or security admin role?

https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-2017