Perhaps I don't understand your question...each voicemail has the ability to be PIN protected. The PIN is set in the extensions settings. If you have enabled PIN protection, then the PIN is required on each access.
I asked this question to a 3CX support engineer once and this is the answer i got
"There is no way to manually unlock a voice-mail account once it has been locked out by entering a wrong PIN number 3 times. However it will automatically unlock after 5 minutes."
so you should be able to tell your user just to give it 5 minutes and they should be good to go.