I don't think there is much that can reall be done to fix the fundamental problem which is that system users and regular users have to live in the same namespace causing a risk of conflicts.What is the correct way to deal with this kind of problem ? I cannot find in the policy something about conflict between system and non-system user.
There are two things I can see you could do to impreove the situation with your package. 1: Fail early, it's better to have preinst fail than it is to start creating stuff with wrong permissions/ownership. 2: Choose a less generic name that is less likely to cause conflicts. Do you plan to use this user only for the db? if so tango-db might make sense, if not maybe something like tango-control-system.