Adjust this however you need.. or your could invert it, to control commands.deny, for example if you want a 100% block of CMD_DB_* functions, just list all CMD_DB* and CMD_API_DB calls. (although, simply setting a max of 0 databases would accomplish the same)
Relating to the user_create_post.sh, there is a user_modify_post.sh hook script. Since you may want to turn a feature on/off we need this too, but since the user_create_post.sh literally does the same thing, we can simply create a symlink to it:
ln -s user_create_post.sh user_modify_post.sh
That's basically it. You can now select the "E-Mail Only" option from the package, or for a given User, and it will apply this commands.allow file to them. We'd also recommend setting all related other functions to 0 (eg: Max: 0 databases, 0 ftp accounts, etc), as applicable.