As Rob Caron posted, there's a new Microsoft Visual Studio Team System Licensing white paper. Now, I'm not a lawyer, but I could follow what it's saying and think it's much clearer than the previous version (and even that one basically made sense to me). Here's a few tidbits based on the common questions I've seen on the forums:
On that last point- generally the two devices/users are your service account and reporting service account. The former will have administrative TFS privileges by default (due to the nature of the operations it performs), while the latter basically gets read-only access.
Hope this helps! If you have any questions, I may not be the best person to answer but can certainly try to find out what you want to know.