If you haven’t done so already I would try including "verify_email": false in the payload you’re sending to the create user endpoint; that parameter is documented in the Management API explorer and a I also did a quick test with a email passwordless connection and creating the user with that flag did not result in any email being sent.
As additional information, in my test I also had the welcome email template disabled; you did not fully specify which email you were receiving so you may also want to check your email templates settings.