Education, threats and tools.
The first mitigation for security issues is to enlist users. You cannot obtain good security without their awareness anyway, so you might just as well ask for their help. Publish guidelines on how a password should be chosen.
To strengthen the previous point, pressure them a bit (just a tiny bit). Speak the fateful word: "responsible". Humans being humans, some will need the extra incentive; notably, taking care to explicitly spell out whose fault attacks will be, will emphasize the seriousness of the issue. People won't believe in the importance of the security issues if you, as server maintainer, do not do your homework. These small, thinly veiled threats will push the users into the slightly uncomfortable zone where they are alert. Don't overdo it ! You want users who comply, not users who fight your system.
At that point, help the users. The basic fact of password generation is that humans are no good at randomness. But randomness is what is needed for a password. Since this is a webapp, you have a trusted Web server -- "trusted" in the sense that the password is to ensure the safety of that server, so the server itself cannot be an enemy (it would make no sense). Thus, use that server: include a password generator. Something which will produce good passwords, accessible with one click.
The two facets of password generation are that the password must not be guessable, but it must be memorized nonetheless. By giving rules for password generation, you assume that the mnemonics by which the user will remember the password will match exactly the process by which the password was created. This is an artificial restriction. Consider the famous XKCD password generator: the generator is not about choosing four words which "make sense" together; instead, it is about selecting four words at random and then, only then, find a "meaning" for it (such as the ungulate mammal pondering electricity storage devices). This highlights how strong passwords are produced: use randomness, then train the brain to cope with the result.
A password generation scheme I am rather fond of goes thus: generate two letters, then two digits, then two letters, then two digits. To please inflexible application interfaces, make the first two letters lowercase, and the other two uppercase. The entropy of this generation process is 104*264, i.e. a bit above 232. 32 bits of entropy are not bad: it will take an average of more than two billion tries to break a password of that kind. This is enough for online security (it would take much too long for your server to "try out" that many passwords). On the other hand, I find that this random passwords are easy to remember. Try it ! You already remember phone numbers, which are numeric-only; the letters are great "anchors" for the mind, and make the memorization only easier. Here are five passwords of that kind, freshly generated (I did not choose them):
For each of them, I wage that you are already finding a simple way to "rebuild" it in your brain, as if you had created it in a witty way. But since they have been generated with real randomness, their entropy is intact.