Is it possible to know if Mac system activity was done in this mac or in another mac? Could I use the system logs to know if log-ins, log-outs, etc were done in this Mac?…how can I know the user didn’t put the storage into another similar Mac and operated the machine from that mac?

Any books/articles/courses explaining this stuff? (without having to do a degree in digital forensics)
You can use the command line tool last to list sessions of specified users.

I cannot find an online manual that Apple hosts so I found the closest thing I could.

https://www.freebsd.org/cgi/man.cgi?query=last&amp;sektion=1

For example in the terminal.app you could type

last "name of user" 


That command get a list of logins (among other data for the said user - see above link for specifics)  However should be able to get a sense of when the user was on the computer or not. Therefore determining if the user was on a computer at a given time. This won't tell you what files the user transferred or accessed. But, you might be able to narrow that down if you know what machine a give person was on at a given time.