RSA sells two things; Authenticators (Tokens, etc...) and Active User Limit License (the total number of individual users that you can assign one or more Authenticators to (including Fixed Passcodes).
So you can purchase tokens, that last for a specific amount of time, and you can assign three of these tokens to a single userID and that only counts as a single license hit.
A common problem is when users leave a company they still count against the License until their Tokens are unassigned. A Clean up job can do this for you automatically.
Some more detail from a previous discussion on this.
https://community.rsa.com/message/942391?commentID=942391#comment-942391
