(1) is there a timeout for a logged in user ?
Yes, their session expired. The duration can be adjusted within Joomla global configuration.
(2) can the user be logged off if the user closes the browser ?
No, but they're more or less being logged out when their session expires. Problem is they're returning to your site on a URL that's only accessible to logged in users, which is why they get an access error.