Can I configure DirSync NOT to rename existing accounts? I want DirSync to ONLY update users passwords and group memberships, and clone new users, but NOT to rename existing users whose target names are different from the source

Any target attribute that you want to keep different from the source, you skip in the Directory Sync "Skip Attributes" UI.

if I skip sAMAccountName, will dirSync be able to create new users on target?  sAMAccountName is a mandatory naming attribute and if I skip it from "sync", will it be skipped from "create"?

Yes, but you will no like the samaccountname vaule. In this case you can only match to existing objects. You can't have both

Thanks Jeff.  Looking into it further, I determined that the real issue is the target UPN of the users. We need to keep it in First.Last format to match Office365 accounts. So if I let DirSync change sAMAccountName but force target UPN to be @mycompany.com (in sync configuration) while at the same time configuring DirSync to skip UPN attribute source to target, would this work?  How does the logic flow when I configure "Set the domain suffix of the UPN to mycompany.com" in "User Principal Name handling" while at the same time I skip "UPN" for users "source-to-target"?

The way the UPN is handled, you have a few options, Sync does what you would think. It copies the source value to the target. If you select change, it will leave the local part and change the suffix only. Bob@OldCompany.com becomes Bob@NewCompany.com  of any of the other registered UPN suffixes in the target directory. Skip UPN is another option in the UI. Don't use the Skip Attributes UI to skip the UPN.

Does that help?