SharePoint knows that list. At least SharePoint knows which users have explicit access, which users have access via a SharePoint group, and which AD security groups have access ( either explicitly or via a SharePoint group... ).
Knowing this, you can browse all the SPSite's SPWebs (
SPSite.AllWebs ), then browse each SPWeb's SPUsers (
SPWeb.SiteUsers contains that list ), then, if the SPUser is an AD security group (
IsDomainUser == true ), you can use a third party Active Directory Add-On to browse the AD group recursively for all users within it ( check out the powershell
Get-ADGroupMember cmdlet if your server farm supports it - but there are other ways to do it ).
During the browsing process ( before expanding into the AD security group tree ), you can access each SPUser's permission using the SPWeb object (
SPWeb.GetUserEffectivePermissionInfo() ) and filter the SPUsers which don't have the required permissions.
In practice, you won't get a SPUser object instance for each user having access to your site, but you will get an exhaustive list of logins & other substantial infos matching this criteria (depending on your third party tool for browsing the AD).