The /etc/passwd & /etc/group files do not exist on new filers/vfilers, so you may have to create them. You can use the "New-NaCifsPasswordFile" and "New-NaCifsGroupFile" commandlets without any arguments to create them. After that "Set-NaCifs" should work.
I've run into the error where I could not create users through a vfiler context in PowerShell/ZAPI but I could through the commandline, but I don't recall what the problem is/was. Anybody else want to chime in with the answer to that one?
Which version of the Toolkit are you using? If you issue a Get-NaUser command to the vfiler, is there a root user in the output? I am able to reproduce the issue on my side if I try New-NaUser before a root user exists on the vfiler. If you are using a pre-1.5 version of the toolkit (toolkit 1.5 was just released at the end of last week), then the Set-NaVfilerPassword cmdlet will fail to create the root user on the vfiler if it does not already exist. See this thread for more information: http://communities.netapp.com/thread/14445
In my test, once the root user was created, New-NaUser worked as expected.
I think the problem is the useradmin-* ZAPIs expect the user of the pfiler to exist on the vfiler when called using vfiler tunneling. In my case, I was logged into the pfiler as root, so everything worked for me once the root account was created on the vfiler. Connecting directly to the vfiler avoids this. Once you create the necessary users on the vfiler you should be able to go back to using vfiler tunneling.