Francis,
At this time it is not possible to restrict a domain to a maximum number of EAS users. If EAS management is enabled on the domain level, any domain administrator may add a user to the list of ActiveDirectory mailboxes.
The only way to accomplish enabling EAS for a given user via the API is to call the Services/svcUserAdmin.asmx?op=ToggleActiveSync method.