1. Create a new user
2. Give this user permissions to a group that has project USE permissions only. But do not put this user into a group that has Global Permissions:JIRA Users.

This user will still appear in mentions autocomplete during commenting even though this user has no ability to login to JIRA.