This is possible with the use of smart groups. It requires a bit of tinkering and you'll have to manually enter the passcode on the device (If you want the passcodes to be the same on every device) but once a passcode is present it should retain that passcode.
The way this is done is by creating 2 smart groups; one for device without a passcode and one for the device that have receive a passcode.
The first smart group should contain the filter "Has passcode = No". This will add every device in your system that does not currently have a passcode, You add a profile to this smart group that requires you to set a passcode.
The second smart group should be the exact opposite of the first one; it contains the filter that has "Has passcode = Yes". This group will receive the iPads that you've entered a passcode for. In this smart group you add a profile that does not allow the user to modify the passcode.
Once the device lands in the second smart group it now has a passcode that cannot be removed or modified, since it automatically gets removed from the first smart group.
Please keep in mind that when you send in an iOS update to the device from ZMS passcodes get cleared and you'd have to do this again.