On Ubuntu 14.04 I creating user with disabled password like:
sudo adduser --disabled-password myuser
I need to do same with Ansible
user module use useradd command under the hood.
If you omit password parameter for user module, ansible calls useradd without -p flag.
Man page of useradd states:
-p, --password PASSWORD
The encrypted password, as returned by crypt(3). The default is to disable the password.
This is exactly what is needed by OP.
Comparison of adduser --disabled-password test1 and - user: name=test2 state=present:
# grep test /etc/shadow
test1:*:17031:0:99999:7:::
test2:!:17031:0:99999:7:::
# passwd -S test1
test1 L 08/18/2016 0 99999 7 -1
# passwd -S test2
test2 L 08/18/2016 0 99999 7 -1
As you see in both cases passwords are locked.