Setting the scope to session doesn't mean that all User instances live in the session. It means that there is one seam component type called "user" that seam will manage in the session. Usually this would be to manage the instance of the user that represents the current logged in user. Perhaps it would be clearer if the component name were "currentUser".
Remember, of course, that a EJB3 bean can have multiple roles in Seam. If you used User in another way in the same application, you could give the component another role. (an additional name/scope)
To answer your question, yes it means that the seam-managed "user" component would be stored in the session. The fact that you are accessing from a stateless component is not relevant. Yes, changing it to EVENT would store it in the request. I think entities default to conversation scope if you don't specify otherwise.