Personal access tokens are generated in Bitbucket Server. The token you add must have project admin permissions for the projects that you want Jenkins to build from.

Providing this token will allow your users to automatically set up build triggers when creating Jenkins jobs. They won't be able to use it for anything else.