For a system operating headless, the objective is, for each of several users, to maintain a desktop session, which may be accessed remotely, persists across client sessions, and is protected by user credentials. Any of the common desktop managers (e.g. lightdm) is available.

In other words, when the system boots, it should open a desktop session for each of several designated users, and then allow each user to intermittently connect by a remote desktop protocol to the corresponding session, but not to the sessions of other users. The client should be able to disconnect without disrupting the applications running in the desktop session.

What is the best approach?

(It would be preferable to avoid assigning a separate, static port number to each user, as is generally required for VNC access to multiple simultaneous sessions.)

no. I mean a real server does not need any dm, any session. You can start your own window manager/desktop on your on laptop/desktop pc/dedicated host and connect with ssh or wathever else you wish.
By the way how many users do you want to handle ?

I am targeting about five users.

I am not sure what you mean by a "real server". The object is that desktop sessions would be always available, persisting across client connections. For SSH, if a connection dies, so do the processes created under it. Maybe you can think about the box as a client for remote access, rather than as a server.

Creating the sessions at system boot is a lower priority than preserving them across client connections.

it looks like you need some kind of VNC or similar (if I understand well). That may mean the session will be started at the first login attempt and will be running as long as it is shut down. You can reconnect any time (in case of lost connection or similar). Sessions of others will not be available without authentication (knowing the credentials).
I do not really understand what is your problem with VNC.

(I thought you are talking about a lot of users (more than 100) and several different hosts.)

I have no problem with VNC, but ideally users would not need to be assigned an individual numeric port number, whereas VNC, as I understand, maps each desktop to a port number, without support for authentication based on user name. Some VNC server configurations, such as that managed by lightdm, are quite tedious to use as clients, requiring a separate connection through SSH with port forwarding before connection using a VNC client is attempted. Any simplification would be useful of these procedural details for regular use.