You can't use Dependency Injection (@) in the methods. So this won't work. Servlet's local variables are thread safe, so if you want to use session bean, you should use lookup method from the InitialContext.
It all depends of the type of the bean, if you have got stateful bean you shouldn't use DI, but if the beans are stateless you can use it and don't worry about thread safe.
And now your second question. Again it depends of the bean type. If the bean is stateless there will be just a few (probably, but it ofcourse depends on the configuration) beans in the pool, and all the 'users' will use them - these few beans . When they will be created (@PostConstruct) - the data connections will be open, and thanks to this, everybody will use it. Stateless beans are not created very othen. It would be very bad if you would open connection in the business method - then, every request would open the connection - this would be inefficient.