Box 1: User1 only.
User1: The Owner Role lets you manage everything, including access to resources.
Not User3: The Network Contributor role lets you manage networks, but not access to them.
Box 2: User1, User2, and Users3 -
The Owner Role lets you manage everything, including access to resources.
The Security Admin role: In Security Center only: Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations.
Network Contributor role lets you manage networks, but not access to them. This includes Read roles and role assignments
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles