Should Account-level in BIP32/BIP44 be Hardened?
For simplicity, each user uses the same wallet address (unique to each
  user) for all subsequent deposits/withdrawals.


Realistically, this wouldn't be the case - maybe for withdrawals but not for deposits as it gives away too much informations about the individual user. You should track balance by user in a different schema and use invoices to handle payments and withdrawals. The reason I bring this up is because you're asking what is general practice in Question 1. 


  Question 1: Is it generally practised to let each user have a
  different account level node? Eg: User 1 has m/44'/20'/1, user 2 has
  m/44'/20'/2', etc.


I wouldn't. This system not only links the money in the system, it also links who has how much money.


  Question 2: Assuming the above question is correct, should the account
  level key be hardened or not hardened?


As you mentioned the derivation path is as such

m / purpose' / coin_type' / account' / change / address_index


This means the account depth should be hardened. Failure to do so will be an anomaly and if I put the master private key in a different wallet, different addresses will be generated. So the answer to your question is yes, it should be hardened.