Users are any users with a login in your hosted instance. Concurrent users are not counted - anyone who can log in counts against your user limit.
You can remove users from your instance (without losing any data), if you are hitting your user limit. You can add these users back at any time. You can also upgrade to a higher tier to allow for more users.
Any active project counts against your project limit. Projects which are no longer used can be archived (puts the project into read-only mode), and will not count against your project limit.
Deleting projects will also remove all content (such as wiki, issues, etc), so it is adviced that you simply archive projects instead of deleting them if you are nearing your project limit.
You can also upgrade to a higher tier to allow for more projects.