This doesn't really explain how users are created and embedded in the accounts. "Access to the collection for User is not allowed since it is an embedded document, please access a collection from the root document." I'll fork and add anything I come up with. Thanks for the start.
@djfobbz: I'm not in a position to answer questions about your problem domain. This was a good fit for me, since in my app I always had access to the current account and so all the user stuff was scoped to that account and loaded automatically, and there weren't many users per account.Your mileage may vary.