Incorporating the error codes and their explanations found in errormap.inc into the access policy deny messages

The best way I have accomplished this in the past is to create multiple deny endings and customize the text on the ending to what the error message should be.

Instead of the default message of

Access was denied by the access policy. This may be due to a failure to meet access policy requirements.

If you are an administrator, please go to Access Policy >> Reports : All Sessions page and look 
up the session reference number displayed above.

You could update it to say

You failed to authenticate please contact the helpdesk if you forgot your password.

Will this work for you?

-Seth