I think you shouldn't use the 'Derives function'. You can also use a reference to system.user ( or a derived object of system.user), so an account can have a user account, but it is not obliged.
Editing the System.Module is not a good idea. See the comment of Benny for Marco's answer.
If the only thing you would like to prevent is users from logging in you could set the attribute System.User.Active to false. The user will not be able to login any more
In case you don't want to fill out a username and password you could use a workaround where you fill the username and password of this user with some random values by MF and set System.User.Active to false and do not assign a userrole. It depends on your application from where you would like to trigger this flow. I can imagine you would create a custom save and cancel button from where you trigger this flow.
What you could do is the following: Go to the derived object: System.User Open this metaobject and delete the validation rules that say that the name and password is required. Once you've done this, you will be able to save an User object without giving it a name and password.