We solve this scenario by allowing connections to untrusted USB devices by a restriction set in advance to all devices. So you can attach a USB ethernet device to the iOS device and thus gain network access, so the clear passcode command can be processed. This may lower the device security a bit, but it's worth it for us to handle this scenario.
That is not something Apple allows, and apple is very adamant about this stance. Apple views your organization the device, and the user owns the data. Your only option if a user forgets their pin is to connect the device to Apple Configurator and wipe it.
Though if a user has a device long enough to forget the pin, and long enough for them to not know the wifi/cell status of the device do they really need that device anymore?
You can provide network access via ethernet adapter, and USB if needed so a device can receive the MDM command to remove the pin. Providing you dont have this disabled with a configuration profile.