Additions to the Confluence REST API are in the works, including user operations. You can follow
this issue to be notified of updates.
In the meanwhile, a combination of REST and json rpc should do the trick (note that these are deprecated and so you should switch to the new API methods when they become available):
To get a list of all active users (requires ADMIN scope for your add-on) POST <base url>/rpc/json-rpc/confluenceservice-v2/getActiveUsers
with the following body (Content-Type application/json):
[true]
To get details for a specific user:
GET <base url>/rest/prototype/1/user/non-system/{username}
To get group memberships for a specific user:
POST <base url>/rpc/json-rpc/confluenceservice-v2/getUserGroups
with the following body (Content-Type application/json):
["{username}"]