i think what you're looking for is something like this:
local user (as you call "machine user") - belongs only to one workstation. has nothing to do with authentication on server resources. handled completely by the local machine, not affected by actions of other machines or servers. if the machine is a domain member, a local user would likely have limited access to the local machine, and no access to the server resources. valid for login on only that computer.
domain user - managed by the domain controllers (active directory). can be members of groups, have policies applied to them that grant/restrict access. permissions come from the parent groups, or the user themselves. has network-wide access to any resource granted to them. can log into any computer (subject to permissions).
