Assuming you want to preserve the sysconfig file and adhering to what's defined in it, I think there is no choice but to patch it to call setuid()/setgid() for the non-daemon mode. Environment variable substitution is only possible in "ExecStart=..." and its siblings, so adding "User=$ATFTPD_USER" to the service unit won't work.