Can a Custom Authentication application allow a username to have blank spaces?

No. The current SmartSDK specification does not allow blank spaces in the USER_ID parameter for the REQ_LOGIN intent. The USER_ID can be up to 32 bytes and cannot include blank spaces, colon and double quotation mark (“) characters.