I am trying to understand how Kibana should be installed when using the tar install so that it runs automatically as a service. When you use the repo install it seems like it creates a kibana user but the directions for the tar extract method do not indicate this is needed. Also even when using the repo the install directory is owned by root but you have to change the optimize directory to be owned by kibana and it actually runs as Kibana user. We cannot use the repo in our environment so I want to make sure I can consistently perform this install correctly following best practices as well as ensure I don't have future issues with updates, etc. I ended up copying the elasticsearch.service file for systemd from a test system where I tried out the repo install and that seems to work for starting it automatically. Thank you.
Aside from the repos we don't really have stated best practices for running Kibana as a daemon since it's platform specific. I'd say you're going down the right road by following the repo's formula and running the service under a kibana user that has limited privileges.
I believe this was a bug that has been fixed, so try upgrading.