Might check out tabcmd. createusers and createsiteusers have licensing options. and can also be used to addusers to groups. The REST API doesn't quite yet have all the functionality that we needed, but they are continuing to add more which will reduce the complexity of a solution to keep tabcmd installed and up to date on systems which need it.
Not with a released version. User management has always been Tableau's weakest point.
Tabcmd is slow, single-threaded, file-based, and depending on the version, riddled with bugs. The REST API is incomplete. I've had some success tracing the HTTP interactions done by tabcmd using a proxy, then re-implementing them myself, but needless to say, that's unsupported. Modifying the user database directly is much easier, but also unsupported.
The good news is, REST API seems usable in Tableau Server v9 (currently in beta). There is a "update user" call that will allow you to change the user's role (interactor, publisher, etc).