There are 2 types of tokens. If you just use named tokens then you need one for each user in Qlik.
If you use login tokens then you can have multiple users share the same token. But there are limitation on how long and often they can use Qlik. Under this scenario you can have more users listed in Qlik than you have tokens.
Users are imported into Qlik. There is no way to just add them in the QMC. You can export using excel or sync with AD. There are other options also.
