Without safeties, phaser fire can be simulated by simply using a beam of such low intensity that it either wouldn't be felt, or would be just strong enough so a person might realize they've been hit.
Now, as to the bullets, here's some info from the Star Trek: The Next Generation Writers' Technical Manual (subtitled, "Or: Yes, but which button do I push to fire the phasers?). On page 30, under Holodecks: Theory and Operation:
Entire walls are covered with tens of millions of OHDs [Omnidirectional Holo Diode] since they are manufactured in an inexpensive wide-roll circuit printing process. Dedicated high-speed computers, highly intelligent and with massive memories, drive these OHD displays much like computers drive video monitors today, even the ones with limited 3-D stereo display capability (actually available on some home computers). Which is where the similarity ends.
In addition to their ability to project full color stereoscopic images, OHDs can maniplate EM fields in three dimensions to cause the Holodeck vistor to "feel" objects that aren't really there. This tactile stimulation prvides the proper feedback the visitor might expect from, say, a rock on the ground or a tree growing in an imaginary forest.
In some cases, real objects are created from a raw material supply, using technology derived from the ship's transporter. These objects may appear complex in shape, though their actual molecular structor cannot be complex (as in living tissues, etc.) due to the limitations inherent in transporter memory storage devices.
To create a realistic feel, with safeties on, a gun like the one Picard used, would still need to have a kickback. This could be accomplished with forcefields. But the situation arises about safeties about what would happen if one person held a gun directly against someone's head and pulled the trigger, in a game like Russian Roulette.
If bullets were real objects, there are multiple issues. A bullet in a chamber of a gun would have to be dematerialized when it was shot so it would disappear from the gun and, as we've seen with replicators and transportes, materialization and dematerialization is not only not instantaneous, but is visible by the lights and particles seen floating around the object in question.
So in a "normal" situation, the bullets would be forcefields and holograms.
With safeties off, the forcefield would not be "snuffed" before impact, they forcefield would be projected even as it hits a body.
While that answers your question, it raises others in regards to Picard firing with the tommy gun: How a bullet could damage the body beneath the skin, since projection of a forcefield with the skin blocking it would be almost impossible.
It's very possible that Picard knew the system well enough that bypassing the safeties could have involved changing a setting so the bullets in the simulation were 100% real matter and not forcefields. (I don't remember if he disabled the safety verbally or if he had to manipulate some controls to do it.)