Safe to make new users for ssh access?

I just upgraded my Live II to the TKL ssh-enhanced image. I can ssh in but it currently only works as root. Sure, this is a security risk, but I'm much more scared of it as a footgun.

Could anyone tell me how well the MPC software would tolerate me creating a handful of new users (i.e. new Linux users) and using those users for ssh? Has anyone by chance undertaken such a step?

I could foresee some hazards if the MPC software makes assumptions about filesystem content not being changed by arbitrary (unknown) other users on the box.

Kiks images have their filesystems mounted to SD card so if you break something, you’ll break the SD filesystem unless you explicitly do something to az01internal or mess with partition tables. Main executable „/usr/bin/MPC” runs with elevated privileges in order to be able to modify system files so I don’t really know what would break if you run it as normal user. Anyway, what’s the point of ssh if you strip yourself from privileges that let you use it properly ?

Thank you dustyslices! That is very helpful!

I have installed an internal HDD. I'm thinking to support 2 separate sync flows between my PC and the MPC:
1) regular (e.g. via cron) backup of MPC projects from the MPC->PC, which would need read-only access to whatever folders hold my MPC work files
2) as-needed (e.g. via a manually-triggered script) syncing/caching of raw & roughly-preprocessed audio on the PC onto the MPC, which would need read-write access to some "raw materials" folder on the MPC

Since both of these flows would run a lot, and I want to be able to think about them as little as possible, there'd be value in restricting the possible damage done (e.g. no write access or write access to 1 folder only). I'm also a noob with rsync, which I figure I'd use for at least 1), and AIUI it's easy to make mistakes with rsync...all the more reason for putting in protections against my own stupidity. In general, if I set up regular logins or syncs with root privileges I'm pretty sure I'm going to end up in a bad place.

And then for the not-so-frequent cases where I do want to log in with ssh and do ad hoc things (e.g. I was able to make a new partition table & format fat32 partitions on the internal SSD via ssh...very nice), I'd prefer to:
a) add a key pair and password for ssh login and
b) login as an unprivileged user and only elevate privileges (su root/sudo) when really needed.

I guess the details for that will be a separate topic, but again it will at least make it harder for some ill-conceived scheme of my own creation to go in and really mess up the MPC.