We have an unlimited user license, so I cannot comment on Q2.
However, for every user who you setup on Phantom is indeed counted- even though you are using external auth.
When you create a user, you are doing it on Phantom itself. Only difference is that this user is either marked as a local account, automation account or you are using external auth such as SAML or LDAP etc.
... View more