The default settings for the View user list permission is Members. In my usecase, however, members must not be able to view the user list. Therefore, I set this permission to Admins.
Now, whenever a non-admin member tries to mention another user by typing the @ character, an alert message pops up: "You do not have permission to do that." This also happens when a non-admin member replies to a specific post (rather than a discussion as a whole), as Flarum automatically inserts a @… tag in this case.
Despite this alert message, Flarum still manages to show the list of users that have participated in the current discussion, and this behavior seems perfectly valid. Therefore, I do not see the point of the alert message.