Steve,
Every APM license includes 500 CCUs for any type of access(portal, app tunnels, SSL VPN, etc) plus max license for Citrix remote access. That means that even our 1600 device is going to be licensed to handle up to 1,000 concurrent XenApp remote users with the base APM license. For exact details and sizing, you probably want to have a discussion with your local F5 sales team. Alternately, you can build out a Windows server to run CSG on, or procure an Access Gateway appliance - but you will be missing out on the SSL offload capabilities of F5(as far as I know, CSG does not support SSL offload for ICA proxy) and TCP optimizations(more information here: http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/2040/aft/1180487/showtab/groupforums/Default.aspx).
Also, APM 10 CCU licenses is included for free with all LTM devices - so you can try our solution by simply provisioning APM on the device and following the deployment guide and/or iApp - and decide for yourself whether it is worth investment in the APM product.