The SQL standard does not, and cannot, prescribe what data are returned from or updated in a SQL database; it is about syntax and semantic rules of the language. A compliant DBMS could return different results to the same user in response to the same query, and still remain compliant. In fact, this happens all the time -- see transaction isolation levels.
The opposite (same result in response to different queries) is also true -- the BLACKHOLE storage engine doesn't make MySQL any less standard-compliant (which isn't much, but still).
In other words, your question:
Is it possible that user1 receives 100 rows, and user2 only 80?
is entirely outside the scope of the SQL standard and is subject to individual RDBMS implementations, which, as others have mentioned, may have specific mechanisms to allow that.