User stories work best when you don't have to worry about all the non-functional stuff people 'just assume will work'
The best way to deal with this is to first setup your basic environment/architecture framework. ie
"We are making a website, ergo we will need our standard microsoft stack, IIS + C# + Asp.net + MVC + MSSQL with the usual OAuth2 roles bases auth, Load balancing, Monitoring, Firewall etc etc etc, deployed to Azure"
This will answer 90% of the non-functional requirements. If you are doing something in the standard framework, then they come as standard.
If you have a special non-functional, say "Long running custom process must be able to handle workload X" then you should call it out as a User Story. "As the accounts team, we need the end of year report to be completed within X days"