The JSON-RPC has a method called getnewaddress that will generate a new private-/public-keypair and return it to the caller. You can use this to generate a new address for each user. In order to track the balances of users I'd suggest grouping a user's addresses in an account associated with the user by calling getaccountaddress with the user ID or the username. You can then use the getbalance <user> call to check its current balance. However, there are some caveats when grouping addresses with accounts.