We are going to switch to ArcGIS Server, I am quite not clear about the difference about user authentication and app authentication, and they apply to/works for web resources we deliver to users? Thanks.
Your question is a little vague. What exactly do you mean when you say you're switching to ArcGIS Server?
To learn more about ArcGIS Server security, I would start with these 2 resources:
Hope this helps,
Retrieving data ...