ok, that helped a little.
I was a little unclear: what I meant by system users, was creating CP users from ispcfg3.
if I just create a client, he doesn't get access to ispcfg3, right?
so basically a CP user is needed to have a reseller account, except that a cp user doesn't have any limits so he can't create clients.
am I just not getting the point or is this feature not implemented yet?