Understanding DEM accounts and licensing

We are trying to understand the right way to deploy corporate devices that I'll call "shared" among staff. Specifically iOS devices. We started out thinking we needed to buy tens of thousands of device licenses as they weren't tied to a user. Then start reading about this DEM account idea. If I'm understanding it right, I can create 150 of these DEM accounts and each can enroll 1,000 devices. So then I could enroll 150,000 devices without paying for any licenses? Or do I just need to buy 150 "user" licenses and can enroll 150k of devices for no more cost?

What if I need to move to like plan 2 for these devices for say tunnel capabilities. Do I have to pay per device or just for the 150 "user" licenses? Is it really free vs paying even for the "DEM" accounts? Curious if anyone can explain how these accounts work as even though we have an enterprise account with MS no one there seems to be able to explain it to my satisfaction.