Google Analytics metrics
First of all, you need to understand how Google Analytics calculate those metrics:
- User: Users who have initiated at least one session.
- New user: First-time users during the selected date range.
In your data, you have 280 users but only 40 are new. I don't think that's strange in any way. As you have been told in a comment, you can check Google Search Console > Search Analytics Report to know exactly how many people clicked on your organic results. That should be close to 280 for the same period.
Google Analytics uses the ClientID stored in the cookie to keep tracking of users. That's how we can know if it's a new or return visitor. By default, the cookie (_ga/_gid) expires in two years. If the users delete the cookies, we lost track and will be considered as a new user again.
You can use Analytics User Explorer to analyze the behavior of your users. This tool will help you to understand how people navigate through your site and make sense of the metrics.
In theory, total users should be the result of new users + returning users but in real life, we can check that this is rarely happening. The main reason is that new users over several days may contain duplicate counts for sessions that cross over the midnight hour. It is a sum of daily new users. Google Analytics restarts sessions at midnight, so a single user (and session) could be counted twice.
Also, keep in mind that Google has made some changes in those metrics during 2017 and also that some reports could use sampled data.
In early 2017, Google Analytics began updating the calculation for the Users and Active Users metrics to more efficiently count users with high accuracy and low error rate (typically less than 2%)