Hard to say if it's better. Accounts and logins are som common that it might be alarming to not have such.
But I think you might run into problems using auth_user for this. And I don't see what you gain out of using auth_user. I would just attach an email address to the order and then code any necessary business logic. If the customer eventually registers, you would then be able to associate all of their previous orders with the new account based on email address. Caveat: make sure there are no security issues related to unconfirmed email addresses. For example, could I register as [email protected] and be able to see what John Doe has purchased previously?
