create SSH accounts using RADIUS pam

I use the REST module of RADIUS to validate login requests (username & password). Now I would like my users to be able to login to some servers using SSH. Their accounts should be all very unprivileged (just for SSH tunneling). After setting up the pam sshd module I recognized the login would be only possible by creating a new user with an empty password by using: adduser testuser on the server. Is there a way to prevent this and allow users to login in case of RADIUS accepted their username & password. I already searched for this problem: http://serverfault.com/questions/567628/authenticate-radius-user-using-pam-a... Setting up ldap would be a bit too much for this I think, isn’t there an easier way? All the best;