Update: Apparently 10.13.4 just breaks this completely (defaults write commands won’t do anything any more). Thanks to tristan on the MacAdmins Slack for pointing this out.
In macOS 10.12 (Sierra) and earlier, you could go to System Preferences > Security & Privacy > General > Require password ________ after sleep or screen saver begins, and that would populate the askForPassword and askForPasswordDelay keys in ~/Library/Preferences/com.apple.screensaver.plist for the user.
In macOS 10.13 (High Sierra), setting that preference in the GUI will not make it appear in the relevant .plist file. However, setting the preference with
defaults write com.apple.screensaver askForPasswordDelay -int somenumber