When customers are invited into an Experience Cloud site rather than self-registering, the normal Salesforce pattern is to create them as contacts, add them to the site, and enable the welcome email so they can establish their own password from the invitation. Login flows are not the primary mechanism for initial password setup, and updating site membership through an API does not replace the standard invitation process. The important architectural idea is that the user lifecycle begins with site membership and an activation journey, not with self-service reset logic. Salesforce's welcome-email flow is specifically designed for this moment: it gives the invited external user a secure path to activate access and define their password for the community.
This is why options A, D work together as the correct solution.