"It is very important to force users to add non alphanumerical characters and a few capital letters in the password IF security is very important for your application."

This is a mistake. Virtually all users respond to these requirements using one of a small number of tactics. The requirements add little to no entropy, which makes them very dangerous, because that leads to the mistaken belief that "all our passwords are strong".

The only secure password is a randomly generated one. You can use words/phrases a la diceware or xkcd if it's easier to remember.