Hello prashan,
I would first of all like to recommend that you investigate migrating your current Access Server installation data to a new instance running Ubuntu 22.04 LTS. Because Ubuntu 18.04 LTS standard support (there is an extended paid version available) ended April 30th. So no new security updates and also probably no new Access Server releases will be made for it.
Aside from that, this is a common issue. Ciphers are chosen to strike a balance between security and backwards compatibility. Since you're dealing with compliance you will simply have to select ciphers that make that compliance check happy and forget about the backwards compatibility.
The documentation you found and reference in your post are for the encryption of the VPN tunnel, not the web service. You can set a custom cipher suite string for the web service using the instructions found here:
https://openvpn.net/vpn-server-resources/managing-settings-for-the-web-services-from-the-command-line/#selecting-a-custom-cipher-suite-string-for-the-web-server
The cipher suite string is based on standard OpenSSL naming scheme for ciphers, so you can use documentation from OpenSSL to create a set of cipher suites that are acceptable to your compliance check, and remove all others that you don't want, and then load that cipher suite string into Access Server and restart the Access Server service to apply the change. It should then pass the compliance check.
Kind regards,
Johan
