In EE there is a nightly LDAP sync worker that will auto-block any LDAP users that are no longer in the directory. This should address the active user count issue for licensing.