Unfortunately, you cannot refuse using QBUser.
Both password and login will be stored in it. Each custom object has User Id field, so you can use it to connect user and custom object with data.
Every time you create an object this field is filled in with ID of a user who created this object.
That is the way you can create a table in custom objects and add all required fields.