The User resource has methods to create and manage CloudGuard users. This includes applying IAM Safety protection, and pairing mobile devices to users (they are used to open dynamic access leases and to grant IAM Safety access to cloud acounts).
To understand the roles/permissions refer to following article.