An instance is eventually going to be garbage collected once there are no strong references and the instance is disconnected from the data model. If an instance is present in workspace and all references in our code are removed, it will still remain intact where it is.
The case of player and character instances is more delicate. They are not destroyed automatically unless PlayerCharacterDestroyBehavior is manually enabled, and neither were they in the past before this property existed. During the course of the next year, the opt-in behaviour is going to become default (applies to server!). More in the announcement post.
Back to the main question.
Your thinking sounds about right and @Wigglyaa answered you already, so take this as a short extension of their reply.
UserIds are labeled as int64, though Luau does not distinguish between ints and floats, treating them all as number type, which is double, that is, (double precision) 64-bit floating point.
LuaVM accesses instances via userdata, and a variable essentially points to it. Tables, instances, functions… these are all objects passed by reference, whereas, for example, numbers and booleans are not. Those hex numbers Wigglyaa mentioned are related to the VM’s special registry to keep track of all instances for identification purposes. It does not pose as a strong reference to stop collection.
Simple showcase
local original = {"something"}
local reference = original
table.remove(original, 1)
print(reference[1]) --> {}
original = 5
reference = original
original += 5
print(reference) --> 5
So yes, variable references to instances are comparatively very small in size. The implementation details for the registry and exact sizes are hidden somewhere in the source code.