The act of creating a user in the user table will not trigger the private user count. They also have to sign in and fall into the private user category based on @Darren_Murphy’s flowchart.
User counts reset every month and count again as users sign in during your billing period.
If your app is set to private then other users cannot sign in besides those you have approved. If you allow anyone to signed in, but you utilize Role functionality, then only those users with an assigned role will be considered private…and again, only if they sign in.
Yes, if you want to use your own app