I could solve this issue - finally.
The reason was the sender email address discourse uses by default. It is built from the hostname entered in setup (in my case something similar to v220200xxxxxxxxxxxx.powersrv.de) resulting in the sender address noreply@v220200xxxxxxxxxxxx.powersrv.de which is rejected by the smtp server.
So, why do I use this non-friendly host name? Just because the server is meant to replace the existing one which is getting too small for our grown discourse community. I am preparing and testing the new server before switching DNS settings to point to this new server later on. Just want to save the time to create temp friendly DNS settings here.
How to fix the issue?
Search for these lines at the end of your app.yml:
## If you want to set the 'From' email address for your first registration, uncomment and change:
## After getting the first signup email, re-comment the line. It only needs to run once.
Uncomment and adjust the last one to an address your smtp server accepts as a valid sender, e.g.
- exec: rails r "SiteSetting.notification_email='USER@DOMAIN.TLD'"
Now run ./launcher rebuild app to make the changes take affect and voilà - now the activation email is sent and you can activate the admin account and finish setup.
How did I find out?
I created a new mail account with my webspace provider and ran discourse setup again with these smtp credentials - and got the activation email as expected. So I knew it must have been related to the smtp settings (and not any other things related to the ubuntu / docker / discourse setup).
After activating the admin account with this other smtp server, I went to settings > email > skipped and found the failed attempts to send the activation email: 553 5.7.1 <noreply@v220200xxxxxxxxxxxx.powersrv.de>: Sender address rejected: not owned by user USER@DOMAIN.TLD
Conclusion
I would like to point attention of discourse dev team to the feature request Suggestion - allow optional system email “from” setting during setup. Please consider test installs (e.g. as a copy to run some tests prior to actual upgrade of an instance) not having a friendly host address. It would be so more smooth to set these up without havng to go to app.yaml. Also, in my opinion it is good to give the admin the choice to use email adresses not bound to the discourse host name.
Thanks 
Also thanks to @codinghorror for pointing me to look for how to post code blocks