If the /noservice switch works, why not use it? In a push, it defaults to starting under the service, and then switches to a different account. Here's a dev comment on this from a while ago:
Have they tried using a /noservice switch on the ccmsetup command? Often, the reason ACLs become an issue is because the machine account can’t access the SMB share. If you run /noservice you’ll launch under the context that you spawned the process from. Since they needed the right ACLs just to access ccmsetup.exe from the mp SMB share, it should have the right ACLs to download the content too