Reference: https://www.oracle.com/a/ocom/docs/cloud-training-compute-services.pdf#page=8

This topic describes how to set up and manage a Network Address Translation (NAT) gateway. A NAT gateway gives cloud resources without public IP addresses access to the internet without exposing those resources to incoming internet connections. You can add a NAT gateway to your VCN to give instances in a private subnet access to the internet. Instances in a private subnet don't have public IP addresses.
With the NAT gateway, they can initiate connections to the internet and receive responses, but not receive inbound connections initiated from the internet. NAT gateways are highly available and support TCP, UDP, and ICMP ping traffic. Reference: https://docs.cloud.oracle.com/en- us/iaas/Content/Network/Tasks/NATgateway.htm?Highlight=NAT%20gateway

Correct. User access and permissions are managed by the customers.

Reference: https://docs.cloud.oracle.com/en-us/iaas/Content/FreeTier/freetier.htm

Reference: https://docs.oracle.com/en-
us/iaas/Content/Balance/Concepts/balanceoverview.htm#ariaid-title1