By Salesforce's definition, the User object:
Represents a user in your organization.
Each user has a different License. You definitely do not want all of your customers using the Salesforce license type. It will get outrageously expensive and there is absolutely no need for them to have access to all of that data. What you really want is a Customer Portal with use of the Customer Portal License Types. These licenses are generally assigned to specific contacts on an Account. However, in the B2C model, Salesforce has something referred to as Person Accounts (as you hinted at above):
A person account is an individual consumer with whom you do business,
such as a financial services client, an online shopper, or a vacation
traveler. Person accounts are applicable to organizations that operate
on a business-to-consumer model as opposed to a business-to-business
This essentially allows your Account object to act like a Contact in several different scenarios. One of those scenarios is enabling the Customer Portal for a specific Person Account. This will create a User record that is then associated to that Person Account. Portal Users act a bit differently than your standard user, but this will force your customers to log in through their own portal rather than attempting to log in through your actual Salesforce instance (which you never want to do). You can then configure the portal to allow the user to only be able to access their own specific data and their own specific subset of functionality.
NOTE: There are costs associated to all of this. These licenses for the Portal Users cost money. Get in contact with your Salesforce rep and work out how much all of this will cost before you make any decisions.