Each server/instance can have more than one database. The common security folder has all user logins. With each login, you can assign its permission to each database. Role is the same but better for management. Common sense is, you assign permission to role, then, join login to role which make the login has same permission as role. For example, if a role has tons of logins, and one day you want to change a permission, you don't need to change each login. One touch on role can solve the problem.

On each database, you can see the assigned logins/roles. So, it is a two way process. Either way will work.

Right-click on login, select properties, you can assign which database this user login can access and its permission.

My two cents.