To create the system user you can leverage the Repo Init service i.e. create an OSGi config under the deafult run mode with the below name:
org.apache.sling.jcr.repoinit.RepositoryInitializer-projectname.config and add the following content to it. You can customize as needed and once the code is deployed the system user will be created and required permission will be set.
scripts=[ " create service user demo-user set ACL on /content/project allow jcr:read for demo-user end " ]
Now coming to Content Deployment which can be done in both Cloud Manager as well as Package Manager. Please see the link below for more details: