According to this CloudKit overview:
CloudKit also enables your users to anonymously sign in to your apps with their iCloud Apple IDs without sharing thei
From what they discussed at WWDC, you'd do this using the fetchUserRecordIDWithCompletionHandler: method on CKContainer. That returns a CKRecordID that corresponds to the current user. This ID will be stable across devices but different for each app-- so if the same person uses your app on multiple devices, your app will get the same result everywhere, but other apps would get different results from yours.
Once you have the CKRecordID you can look up limited other user data (their name and email, I think) using fetchRecordWithID:completionHandler:. This request will trigger a permission alert to the user, so you only get it if they allow it.
This doesn't require you to use anything else in CloudKit. It does require that the user actually have an iCloud account configured on the device.