dofollow and nofollow only apply to links. All links posted by users are nofollow by default.
Once the user becomes trusted (level 3) then the links they post can become dofollow - but you can also turn that off as well and keep all links posted by users nofollow.
You can read more about trust levels here: