When sending transactions into the ethereum network, you have to sign the transaction, a not signed transaction is not accepted. The signing is done via private keys, held inside your network gateway node (ethereum node).
So if you use web3, it will contact the ethereum node via an RPC (TCP) API and ask to sign the transaction by the user private key related to a given address. Private keys usage is protected by password, so you will have to unlock, by supplying the password, it for usage (web3.unlockAccount()) before sending any transaction.
TLDR : You will always have to pass private credentials to be able to send transactions. A possible solution to your problem is to create an auxiliary user system that you manage by smart contract.
Explanation
What I meant with "an auxiliary user system" is a basic user management system, available on any platform, that doesn't use, as basis, the ethereum user and account system. So basically, create a standalone platform and make a link between the users on your platform and the user and account on the ethereum platform**.
An other thing I meant is to use a single user (address) when interacting with the ethereum platform. this address should belong to the platform and should be used to interact with a smart contract.
**The smart contract will manage these new types of accounts ( an account struct with an attribute storing an ethereum address).