So, my question is, if I re-deploy the DB from my local with all of sparkling new permissions that I will design, will the scores of users on the server be overwritten by the measly two that are in my local security DB?
No. There are a number of options when deploying the data. You can overwrite, which just overwrites any record with the same pk...good for static data. You can merge, which will leave any existing records in tact and add the news ones. And you can Ignore, which will only add records for PKs that do not have exist in the database. In this example, you probably want to actually overwrite the permissions (as you could make a change and you want it to be reflected) and Merge the users. So you can do a combination of both. This is the same process that we use for our medical software...we distribute a "default" user, but always deploy all permissions, groups, etc. on an update. Hope that makes sense 