Well, that topic is pretty broad. Let me try to help get you going.

Hadoop and all the tools that run on it will use Kerberos authentication now that it is configured.
User and group mappings will still be handled at the OS level though. So if you do not have LDAP and have it integrated at the OS level you will need to create local users and groups in the OS on all nodes.
Second, both CM and HUE have their own auth backend configuration and authorization. You can integrate both with LDAP, if you have it, or SAML/SSO. If not, you will need to create the users in those systems as well. The HUE users need to match the first portion, the username, of the principal in the KDC.

Now for the specific item you mentioned the HUE admin not having access to the Security app. HUE has its own groups and permissions. So you will need to add that user to have access to the Security app. You will need a HUE superuser account to do this (this is probably the HUE admin you mentioned).