How many client licenses for SSO-enabled Internet app?

I am exploring using the APM with SAML to interact with Okta. The application is accessible to the Internet and at any one time has 1500 concurrent connections (according to the virtual server stats). If I have an APM policy on this VS, do I need to have APM licenses for my number of concurrent users (1500)? I ask as I am not clear if I need to have enough concurrent user licenses for the users currently involved in authentication at one time or the number of users that did use it and are still connected to the VS.