User Permission are categorized as list permissions, site permissions, and personal permissions, depending on the objects to which they can be applied, for example, site permissions apply to a particular site, a collection of permissions make a permission level that allow users to perform a set of related tasks, for more information, please refer to: [User permission and permission level (SharePoint 2010)][1]User permission and permission level (SharePoint 2010)
A Web application can contains as many as 500,000 site collections, manage permissions for so many site collections can be complicate and error-prone, permission policies provide a centralized way to configure and manage a set of permissions that apply to only a subset of users and groups in a web application. The difference between specify user permissions for a web application and creating a permission policy for a web application are user and groups to which the permissions apply and the scope at which the permissions apply, for more information, please refer to: [Manage permission policies for a web application (SharePoint Server 2010)][2]Manage permission policies for a web application (SharePoint Server 2010)
User policy is basically an AD user or AD group mapping to certain Web Application Level Permission policy, there is a good article here about how to apply user permissions, permission policy, and user policy, you can refer to it for more information: http://www.sharepointblues.com/2010/09/01/sharepoint-security-and-permission-system-overview/
https://social.technet.microsoft.com/Forums/sharepoint/en-US/b4ce7e5c-9192-45e7-a550-70614ef0d51c/user-permission-and-user-policy-and-permission-policies-differences?prof=required [1]: https://technet.microsoft.com/en-us/library/cc721640.aspx [2]: https://technet.microsoft.com/en-us/library/ff608071.aspx
