If two services are sufficiently intertwined that it would be a pain to implement them without sharing DTOs and other model objects, that's a strong sign you shouldn't have two services.
Certainly the example makes little sense as two services; it's hard to imagine a specification for 'User management' so complicated it would keep a whole team so busy they don't have time to do authentication.
If for some reason they were, then they would communicate using what are basically arbitrary strings, as in OAuth 2.0OAuth 2.0.
