The reference to "tokens" as used by ZMF Explorer is not the token that zowe uses. The ZMF Tokens are generated when you first enter a ZMF session using your useri/password credentials and a group of 5 'token based sessions' are created and used in a round robin manner each time as REST api call is invoked. THis is to save time by not having to logon/logoff for each and every Rest call made.
The profile used by ZMF Explorer - "type ZMF" should have no bearing on the pr3ofile in use by zowe or any other subsystem. 

You could add secure userid and password to the specific ZMF profile and it will then not be used at the default base level.

You might also want to ask the zowe folk as to how they might suggest configuring the zowe profile in am mannerr that works with multiple subsystems.

I now added user and password to secure credentials, but it keeps asking me for user and password of the base profile, which I don't want, because if I add user and password to the baseprofile, it keeps asking me to enter username and password for zowe.



is there a possibility to specify a own baseProfile for ZMF?

Remove the secure credentials parms from the Base profile if you do not want them. and specify them at the ZMF profile level. If they are present at the ZMF profile level them the ZMF Explorer will not look for them in the base profile. 

You may want to consider opening a ticket on zowe github and ask the zowe folk how to manage mixed subsystem within their overall profile structure.
zowe profiles can take on a very varied format and it is quite easy for one level of profile to take precedence over another level. 

I did remove the secure credentials parms from the baseprofile, yet it keeps asking me. I have to remove the credentials everytime.

I've already made a issue on github

If they are being added by zowe, then the most likely reason is because they are not present in the specific system profile so considered to be missing.
Provide the ZMF profile(s) that you have defined in zowe.config.json 

{
    "$schema": "./zowe.schema.json",
    "profiles": {
        "userpwd": {
            "properties": {
                "host": "changeman-rest.net",
                "basePath": "/zmfrestx",
                "port": 443,
                "protocol": "https",
                "encoding": "IBM-1141",
                "connectionTimeout": 10000
            },
            "profiles": {
                "zmf1": {
                    "type": "zmf",
                    "properties": {
                        "port": 443,
                        "protocol": "https",
                        "encoding": "IBM-1141",
                        "rejectUnauthorized": false
                    },
                    "secure": [
                        "user",
                        "password"
                    ]
                }
            },
            "secure": [
                "user",
                "password"
            ]
        },
        "apiml": {
            "profiles": {
                "zosmf": {
                    "type": "zosmf",
                    "properties": {
                        "basePath": "ibmzosmf/api/v1",
                        "encoding": "IBM-1141",
                        "responseTimeout": 300,
                        "port": 0,
                        "tokenType": "apimlAuthenticationToken"
                    },
                    "secure": [
                        "tokenValue"
                    ]
                }
            }
        },
        "base": {
            "type": "base",
            "properties": {
                "host": "zowe.net",
                "rejectUnauthorized": false,
                "tokenType": "apimlAuthenticationToken"
            },
            "secure": [
                "tokenValue"
            ]
        }
    },
    "defaults": {
        "zosmf": "apiml.zosmf",
        "zmf": "userpwd.zmf1",
        "base": "base"
    },
    "autoStore": true
}

Why does ZMF need the credentials for the baseprofile?

I will try to recreate the problem.

Please provide your zowe.schema.json file that equates to the above zowe.user.,json

I have been able to recreate the issue .
The problem is that the internal zowe method being called to retrieve the arguments is stating that there are missing args in the base profile .
As a result, the ZMF Explroer prompts for what it is told is missing - in this case the user and password along with 6 other arguments which the ZMF Explorer has no interest  in, so those are specifically not prompted for. 

I have an idea as to why this is happening but I need to discuss this with the zowe folk as they own the routine being called. 
They may be able to offer a solution. 

For now, you can probably just complete the prompts when requested to do so. Even though they will not likely be used.