A license is consumed once a user has begun configuring his security profile. The profile is needed when LogonBox SSPR validates a users identity for a password reset, unlock or even logging into the portal for single sign-on or password management.
When 500 users have completed their profile no more users can complete their profile and so cannot use the product.
You can configure LogonBox SSPR to sync to your entire AD of 1500 users but it's advisable to setup OU and Group filtering to narrow this down to the select few who will use the product. This will make reporting from the dashboard make more sense and whenever any reminder emails go out (in the Paid versions) it's only going to those that will use the product.