A quick note from the AppExchange security team: The GA version of User-Mode is fully approved for AppExchange use, although not all of the relevant security scanners are fully updated yet (i.e. PMD won't support use mode syntax until the v7 release). 

As a best practice use a literal AccessLevel.USER_MODE or AccessLevel.SYSTEM_MODE rather than a variable to make it easier for static analysis tools to detect what mode your code runs in. If you have a more complex scenario where you dynamically pick between the two at runtime you should be prepared to document/explain why and what safeguards you take during security review.

If you use the compile time "AS USER" or "AS SYSTEM" syntax, or the SOQL WITH clause versions you're already using a form that's easy to check via scanning and don't have to do anything special.