0) We flag them in some way (user custom form, or belonging to a particular Group or Company) so we can filter for just these folks. They also get special access levels, so they can't do as much in our instance (they can't make reports, filters, views and groupings for instance, so we don't have to maintain whatever they build)
1) Bare minimum, if they get a paid license, it must be because they are being assigned work in some way (or assigning it to others).
2) If they don't log in within 30 days, they get deactivated (no hard feelings and we will reactivate them as soon as they let us know)