Last_login_on attribute at user going to have different behavior at next release. I short the attribute will be updated also when the user access by API, not only by Web UI.
The reason is this issue: Feature #28168: Report which users access the API - Foreman
You can also watch the status of PR at this link: https://github.com/theforeman/foreman/pull/7155