Hari,
First off, this discussion is more appropriate in the Security discussion forum. I will see if I can ping a moderator to move it. CUA is a security administration toolset, and the people who follow the Security discussion forum are the likeliest to respond.
Secondly, your understanding is correct, the trusted system method of configuring your CUA landscape is the correct way to get the result you desire: the user ID of the security admin performing the user maintenance will be recorded as having performed the changes instead of the CUA system user. Yes,it requires that the user admins have accounts in your CUA central client. What is the problem with this? Please clarify.
Regards,
Gretchen