My suggestion would be to make a simple web application that provides a list of available wifi networks and provides a form to the user to select a network add provide a password to connect.
In that scenario the webserver would be running as the root user and can make the settings changes on behalf of the device owner. With a bit of planning you can also allow the owner to set their own passwords and be able to change back to default AP mode if the chosen network is not available.
Last year I started working on something that will do this using python and a framework I created called WebYAML. If you are interested in using this as a starting point for your project you can find the source code here: https://github.com/webyaml/WebYAML
Also If you contact me via private message I can share some of the code i created for configuring wifi in the framework.