Only Administrators may create new Users and Groups or edit existing users and Groups.
All processes for managing Users and Groups are documented here in the Developer's Guide.
Contacts are not Users. Contacts may have a user name and password, but these credentials do not allow access to the Brick River Web Console. Only Users may log in to the Web Console.
A Contact may log in to secure pages to add or edit content - but only if Data Forms have been created for that purpose.
Users may log in to the Web Console - but a User record may not be related to Blog Posts or other Content. Only Contact records can be related to Content.
Contacts may not use the Web Console but can be linked to Content, so...
It is very common for one person to be both a User and a Contact.
Sally Manager may log in to the Web Console using the name Sally and the password: Sally123.
There may be a Contact record for Sally Manager because she writes News Articles and Blog Posts.
If her Contact record has a user name and password assigned to it - those credentials may be the same as her User record credentials - but they are not related. Updating one record will not affect the other.