You have a couple of options.
If you want everything to run in the calling thread, then you can set EmbeddedConfiguration.userRequestSourceConcurrency to 1. This tells the engine to just let the processing thread handle the source queries, which for a local connection will be the calling thread.
To use the SecurityHelper, there is EmbeddedConfiguration.setSecurityHelper. You'll want to look at the JBossSecurityHelper to get an idea of the implementation: teiid/jboss-integration/src/main/java/org/teiid/jboss/JBossSecurityHelper.java at master · teiid/teiid · GitHub