Kdisc98,
CPPM is licensed by "unique authenticating devices" per day.
So the 500 model will handle 500 unique authenticating devices/day. The 5K model will handle 5k unique authenticating devices/day and the 25k... well you get it. Your enterprise users have 3 devices, those are counted as 3 unique devices. Guests have a single device...those are counted as individual devices.
Of the 3 base appliances, you simply get the appliance for the total unique authenticated devices you will have per day and start from there. If you want guest users, you add guest licenses for the number of guest users you think you will have. If you want to onboard, add onboard licenses for those numbers of devices you think you will have.
You first get an appliance (hardware OR software) to cover the total number of authenticating devices per day and you add feature licenses for the specific features that you need. If you are just doing straight AAA authentication, you do not need feature licenses.
The datasheet here: http://www.arubanetworks.com/pdf/products/DS_ClearPass_PolicyManager.pdf under "Ordering Guidance" explains it much better than I could.