wildfly-datasources_7_0.xsd defines dsSecurityType as a choice of either username and password or a credential-reference like so (pseudo code):

(user-name, password) | credential-reference

I think it should be

user-name, (password | credential-reference)

The XML editor in eclipse seems to agree with me, because it marks the following as wrong albeit it seems to be the only correct way to use a password from the credential store:

<datasources>
   <xa-datasource ...>
   ...
   <security>
      <user-name>sa</user-name>
      <credential-reference store="credentials" alias="sa-creds"/>
   </security> 

Error message is
 

Element name 'credential-reference' is invalid.
 One of the following is expected:
- password
- reauth-plugin