In practice, you have two choices: (1) create an integration user that syncs the data from your site or app to salesforce.com, or (2) purchase high volume, low cost licenses to manage users directly within salesforce.com.
The former method is relatively easy, but represents a certain security risk; the user has to have essentially system-wide privileges even though the users it services may not, so the session token must be closely guarded. Also, the code must be perfect or it may unintentionally expose data or allow writes when it shouldn't, etc. Also note that you don't get "extra" API calls by having only a few licenses, so this does not work in your favor.
The latter method is preferred, because you can have the users appear as actual users within the system, including the ability to "freeze" them, reset their passwords, enable or disable them on demand, and leverage the much higher API limits that you'll have available to you, avoid losing cursors on long queries, and so on. In short, it is technically superior in every way save one: cost. While salesforce.com may tout a given license type as "cost effective," that may not directly translate into "inexpensive."
I would advise contacting sales and see what licenses they might be able to offer you before trying to go at it yourself. However, having a single integration user may still be a viable option depending on the volume of data being transmitted. Real-time solutions will probably not be available, because you would presumably need between 10 and 30 API calls per each user that logs in each day, or far more if your application is "chatty." You could probably sync with salesforce.com more frequently than every 24 hours, such as hourly or bi-hourly.
The mobile SDK (now part of Salesforce1) is geared for direct salesforce.com interaction-- it would be expected that the application uses the mobile SDK to obtain OAuth tokens by logging in, in order to execute queries, update data, describe layouts, etc. You would not want to leverage the mobile SDK in a proxy-user ("integration user") experience, because that would be you'd be giving the integration user's session token directly to each client device to directly access salesforce. Using an integration user means that all traffic would be from the app to your server, and your server would talk to salesforce.com directly.