Difference between sharepoint subsite SPWeb.AllUsers and SPWeb.SiteUsers

Based on MS:

SPWeb.AllUsers
Gets the collection of user objects that represents all users who are either members of the site or who have browsed to the site as authenticated members of a domain group in the site.

Note the word "browsed to"

SPWeb.SiteUsers
Gets the collection of all users that belong to the site collection.

My question is: Does this mean SiteUsers is the combination of AllUsers for all the subsites in the site collection? Which means, only includes who have browsed to the site as authenticated members of a domain group in the site? or, it includes users who have not browsed yet?

If I want to get all users, including members of the site AND who have the permission to browse the site as authenticated members of a domain group in the site, how to do it? Does it mean we will have to get all groups in the AD, then check whether the group have the permission for the site?

Thanks