You can type "show keys" to see what you can do.
You can terminate VPN sessions with an L2tp or pptp client without licensing. The VIA client requires its own license.
You can blacklist devices, but if you don't have AP licenses, where are your users coming from? (you cannot blacklist wired users)
Assuming that your users are wireless, there is nothing that you can do without licensing.