Regarding how to create a separate PI Identity for PI Interfaces & assign different rights?
Please go through below video and check KB00833 - Seven best practices for securing your PI Server (Practice #5)
In case of any queries please let us know.
Regarding Error you are facing when adding Identity for PI modules
To edit PIModules DBSecurity PI Identities / PI Users / PI Groups (except for piadmin and PIWorld) must have a PI Identity Mapping. can you confirm if you have checked this?
Have gone through below thread might be similar issue: