You don't have to have a database user for each application user. Database roles are mapped to groups and application users are defined in tables as always and their ids can be used in RLS policies. It's hard to explain in a few words but the main point is that you don't need a database role to map to each application user