DB2 add user with a password
There are no users in DB2 that are not OS users. The client software (not only Toad is guilty of this) makes this a bit confusing: what they show as "users" are actually grants given to the (externally defined) users.

As you have discovered, you can grant privileges to arbitrary users or groups, and no verification is done if those users and groups exist at that time. 

However, to connect to the database and exercise the granted privileges you must authenticate first, and for that you must have the user defined in the OS (or another configured authentication service, such as an LDAP directory).