When SSH password authentication is disabled, there's no way for the new user to access the server — since no SSH key is generated or assigned, unless an SSH key is manually added later.
During site creation, allow choosing between SSH key (auto-generate key pair and email the private key to the user) or Password.
