With a debian/preinst file you can perform actions on install but not upgrade.

#!/bin/sh

set -e



case "$1" in

    install)

        # do some magic

        ;;



    upgrade|abort-upgrade)

        ;;



    *)

        echo "postinst called with unknown argument `$1'" >&2

        exit 0

        ;;

esac



#DEBHELPER#



exit 0

Though as the name implies, this is run before your package is installed. So you might not be able to do what you need here. Most packages simply test in the configure stage of the postinst if the user has been created already. Here's colord

$ cat  /var/lib/dpkg/info/colord.postinst

#!/bin/sh



set -e



case "$1" in

    configure)



# create colord group if it isn't already there

    if ! getent group colord >/dev/null; then

            addgroup --quiet --system colord

    fi



# create the scanner group if it isn't already there

    if ! getent group scanner >/dev/null; then

        addgroup --quiet --system scanner

    fi



# create colord user if it isn't already there

    if ! getent passwd colord >/dev/null; then

            adduser --system --ingroup colord --home /var/lib/colord colord 

        --gecos "colord colour management daemon"

        # Add colord user to scanner group

        adduser --quiet colord scanner

    fi



# ensure /var/lib/colord has appropriate permissions

    chown -R colord:colord /var/lib/colord



    ;;

esac    







exit 0