Hello @David D.
As per my understanding a single user can have more than one session/visit in the selected timeframe (default session/visit timeout is 30 minutes). Therefore, session count should be more than user counts.
For the concurrent information you should rely on session count.
Documented Information: Dynatrace can typically show all the sessions of each individual user, even when those sessions are anonymous or when a user tag has changed or gone missing.
Have a look on the below link for more insight.