User Permission are categorized as list permissions, site permissions, and personal permissions, depending on the objects to which they can be applied, for example, site permissions apply to a particular site, a collection of permissions make a permission level that allow users to perform a set of related tasks, for more information, please refer to: User permission and permission level (SharePoint 2010)
A Web application can contains as many as 500,000 site collections, manage permissions for so many site collections can be complicate and error-prone, permission policies provide a centralized way to configure and manage a set of permissions that apply to only a subset of users and groups in a web application. The difference between specify user permissions for a web application and creating a permission policy for a web application are user and groups to which the permissions apply and the scope at which the permissions apply, for more information, please refer to: Manage permission policies for a web application (SharePoint Server 2010)
User policy is basically an AD user or AD group mapping to certain Web Application Level Permission policy, there is a good article here about how to apply user permissions, permission policy, and user policy, you can refer to it for more information: http://www.sharepointblues.com/2010/09/01/sharepoint-security-and-permission-system-overview/
