Would say a major difference between rep:User and rep:SystemUser is that one doesn't explicitly have a password set, nor is one really needed... The system user is configured in such a way that it can only be used by sub-services that have been mapped with the org.apache.sling.serviceusermapping.imp...