Drupal - What's the difference between $user login and access?

The access field is updated in Drupal's session write handler _drupal_session_write. This means it is potentially updated at every page request. If you look at the source code, you'll see that the access field is, by default, only updated every 180 seconds. This interval can be changed by setting the session_write_interval Drupal variable.

// Likewise, do not update access time more than once per 180 seconds.
if ($user->uid && REQUEST_TIME - $user->access > variable_get('session_write_interval', 180)) {
  db_update('users')
    ->fields(array(
    'access' => REQUEST_TIME,
  ))
    ->condition('uid', $user->uid)
    ->execute();
}

According to the the comments for the fields in user_schema():

access: Timestamp for previous time user accessed the site.

login: Timestamp for user’s last login.

So access would get updated for each page load, login only when the user actually logged in.