Use billed_user_ids to fetch users in namespace

relate #3701

What does this MR do and why?

1. refactor: rename subject to subject(:service) due to latest rubocop rules
2. change scan logic: use EE:Group.billed_user_ids to return all billable users, which will not return guest role in ultimate plan namespace, but do return guest role in premium plan, which means user as guest role in ultimate plan will be blocked, user as guest role in premium plan will NOT be blocked.