Really good point about commish add/drops! That probably would be worthwhile to support through the APIs, just not something we thought to add. As it stands right now, though, if you're an application developer and you get people to agree to give your application permission to make changes on their behalf, you can already make any changes you need to as though you're logged in as them, without needing to do anything with comanagers. So, just get everyone to go through the OAuth flow for your application, and then you can hold onto their access tokens and make all the necessary changes required for them. Does that make sense?
Regarding locking everyone out of adds and drops, that could be a little trickier. It's hard to stop people from just visiting the site and making changes, aside from going through and locking each of them from adds/drops through the site interface, but that would also stop you from being able to make adds/drops through the APIs. I think the only way to really seamlessly support that would be for us to set things up so you could do commish adds/drops through the APIs, since we could say that the commish is never locked out from making those changes.
But if you're pretty sure that people won't cheat and that you don't have to worry about locking them from doing adds/drops, then you should be able to just have them authorize your application and you'll be able to make the changes for them.
(the reason why I'm worried about the comanager idea is that you're limited in how many teams one user can manage and how many times they can join the same league, I believe)