Well they only have their own protected function createUser($password) which by inspecting further uses the Joomla! functionality in making the user $user = new JUser() in their file
It's fine if they use Joomla API to create users as I'd expect that, but in order for you to replace that behavior there needs to be a Joomla event in that function before they do that.
Is CB autoactions able to modify this file or to use this function to trigger all the actions concerning a new user ? I mean adding the default subscription plan, trigger our own autoactions for email etc etc
No, CB Auto Actions acts on events. It can't modify files like that.
Can I use a code autoaction for this with onUserAfterSave and successful return of their function ?
No, you will create an infinite loop of creating users. CB uses normal Joomla user API to create the user in Joomla before creating them in CB.
Suggest asking them if they'll implement a Joomla event in that function that'll let you override the user creation process.