Knowing the number of users is useful, but it is not enough.
At the very least you should be able to estimate the expected number of requests per second in the peek time and the required response time.
Once you know this the safest way to know the limits is to performance test it, either from a simple Java program or from something like JMeter.
For a typical tomcat performance take a look e.g. on this: how to handle 2000+ requests/sec on tomcat?
In general, Spring REST is not going to add much performance penalty and you also can have a cluster of tomcat instances, so the bottleneck might be somewhere else, e.g. in the DB.
As to the microservices question, start with the simplest approach (the monolith) and just make sure you follow standard SW development practices, i.e. have modules and classes etc. It is possible to move to the microservices later, but you should have a real reason for this, since it is more complex.