The real pattern is to write a separate service for user auth and then put everything else into a monolith. The auth service is almost always the first one to be "broken out" so just get that out of the way first. Now you have maximum flexibility.