How should I be using Users and Access Roles in MongoDB?
Because user security is handled with your application and it's application what contacts the database (not user), you don't need to create every user to the database as a database user.

However, it is still good practice to create a user for every application that uses the database system, so that application can only use those databases what that application needs to access and do only those operations (insert, delete, update,...) what that application needs to do. Nothing else.