Select an employee from the approved Employee List, then assign username, role, and module cards. Users cannot be created without an employee. Portal users live in shared_apps_data / appUsers.
Choose Role = User, then check which module cards this person can open. Admins always get all modules.