Box 1: User1 and User4 only -
Owner, Contributor and AcrPush can push images.
Box 2: User1, User2, and User4 -
All, except AcrImagineSigner, can download/pull images.

Reference:
https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles