Fenced users are a security and protection mechanism employed by DB2. They are used to execute external routines (UDFs and stored procedures). A separate process (named "db2fmp") executes the routines. The owner of the process is that fenced user.
Due to the fact that the process is run by the fenced user, the routines in that process cannot access the DB2 internal data structures and DB2 files. So you don't open up security holes that way. Another, equally important aspect is that a crash of the routine won't bring down the whole DB2 engine - as could happen if the routine is executed in "trusted" (aka not fenced) mode inside the db2agent process.
Note that the separate process has, of course, (minimally) higher costs for the communication of DB2 with the routine. With trusted routines, the communication happens inside a the db2agent process; with fenced routines you will have IPC in the picture. As soon as the routine does a bit more than just adding two numbers, the mentioned overhead is usually negligible.