You must count all unique end users who are authorized to access your service. From Service Provider Use Rights (SPUR), “you must acquire and assign a SAL to each user that is authorized to access your instances of the server software directly or indirectly, regardless of actual access of the server software.”