virtualmin and virtual users (postfix/dovecot)

per haps a way to do this is to
create a webmin group, for instance 'postfix'
give this group access to modules you want, like postfix
set permissions and rights to the modules
limit the user to certain directory
add a user to this group (a test user)
test and refine

Im not sure this solves your specific issue but it is the way to grant users additional features.

<div class='quote'>The goal is to have no real system users.</div>

This is a goal that is not consonant with the Virtualmin way of doing things. Why do you not want real system users? If you don't want them to have shell access, don't give them shell access. Database-backed users are not faster than system users (until you get up to a few thousand users or have them spread across multiple machines). And, of course, you lose all of the functionality that Usermin provides.

But, if you have some existing system that Virtualmin needs to integrate with, you'd probably want to make use of the pre and post command features of Virtualmin to execute scripts whenever you make changes to virtual servers. That doesn't change the user model, but would allow you to also add/remove users in some other type of database.