It should be possible to specify user credential not only for SCM tagging interaction but also for Maven deploy. This should also work if the settings.xml file is distributed with the config-file-provider plugin. The credential should only be used on time and not be stored nor printed anywhere and not be available for other users.

A user triggers a release build and enters his SCM credentials:

Options to specify the credentials is missing. May the user has the same credential for both or may not.

Plugin 'config-file-provider' credential configuration: