For a user to access an application that is deployed to SAP BTP (Cloud Foundry),...

A role collection is a set of roles that are required to access an application or a service in SAP BTP. A role is a granular authorization that defines what actions a user can perform on a specific resource. A user must be assigned or mapped to a role collection at the SAP BTP subaccount level to access an application that is deployed to SAP BTP (Cloud Foundry). A group is a collection of users that share the same attributes, such as department or location. A user list is a way to manage users in the SAP BTP cockpit. Neither of these are related to the access control of applications or services in SAP BTP. References:

Define a Role Collection

Assign a Role Collection to a User