The server profile rate limited is shared between all users that are not yet logged in (but may access resources permitted in the walled garden section), as well as users with an IP binding of type ‘bypassed’.
The user profile rate limited is applied to each logged in user.
rx/tx is from the router’s point of view. Data uploaded from the user to the Internet is data received by the router on an interface, so it’s RX. Date downloaded by the client from the Internet is data sent by the router on an interface, so it’s TX. If you want a rate that allows 1Mbps download and 256Kbps upload, it would be 256k/1m.
Simple queues are automatically created for each logged in user based on the user profile. That queue targets only the user’s IP address. The server profile generates another dynamic simple queue further down that targets an interface - logged in users have dynamic queues higher up, so they don’t fall through to the shared rate limit.
This works fine for up to 500 users. Don’t worry about it unless you have more.