Final solution was to replace auth::create_user with the following:
# get authority
set authority_id [auth::get_register_authority]
# create acs user
set user_id [ad_user_new \
$email \
$nick_name \
$last_name \
$password \
{} \
{} \
{} \
t \
{} \
$user_id \
$user_id \
$authority_id]
# approve the member
acs_user::approve -user_id $user_id