My user accounts are system accounts too. This probably isn’t the best way to do it but it has the merit of simplicity. There aren’t many users on this system so managing users this way is easy. More users would need a different management system

srv/salt/users.sls

# Admin account
myadmin:
  user.present:
    - fullname: System Admin
    - password: $12345
    - shell: /bin/bash
    - groups:
        - sudo

# Sets up the user accounts
blogsj:
  user.present:
    - fullname: Joe Blogs
    - password: $67890
    - shell: /bin/false
    - enforce_password: False

Only myadmin has a normal shell; blogsj. Other users will get /bin/false as a shell which makes it harder to log in directly. The passwords are generated by openssl passwd -1