to add a role go to Security Roles in Admin menu and click add. there are a number of options, auto roles are automatically assigned to any new user, public roles are roles, a user can enter or leave by himself. Role groups are for easier administration only, the allow grouping roles logically.

Permissions for Pages, Modules and Folders can be granted to Roles and individual users.

no, public roles are always open to all users (maybe not a solution suiting all needs).