Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?
Either method is fine.  They're both secure.  You can use whichever feels more convenient, given your application setting.

Better yet -- don't try to design this kind of thing yourself.  Instead, use an existing scheme for providing a secure channel abstraction (e.g., TLS).