Making a User reference field without using licences

So I think I know the answer to this question, but I'm just looking for confirmation: can we create User reference fields in applications that references users that do not have access to that application without using licenses for those users? For example, if I'm developing the Controls application (from the GRC Module) and I want the Control Owner field to reference any user in my company, can I do that without actually giving them access to the GRC Module and using any licenses?

And along the same line, is there anything that would require a license besides giving a user access to a module (like giving a user access to the GRC Module)?