This has been answered a lot on Stackoverflow.
f.fields_for :users
And in the controller, you need to build a user:
@organization.users.build
You get Can't mass-assign protected attributes: user
because the user attribute is not accessible, because it doesn't exist.