What are the customer licence requirements when using external authentication ?

If we have X customers in our DB, and want to allow any of them to authenticate against that DB, do we need X Ontime customer portal licences to match ?

How do we restrict externally authenticated users to specifc projects ? 

Thanks in Advance,

Andrew