Mike,

Answer 1: Yes, you will have to add local users in Xeams in order to receive quarantine reports.

Answer 2: Xeams only cares about the Recipient's Email address when determining license count. The way I see it, every member of the mailing list will be using one email address for the recipient and therefore, that is the only address you need to add in Xeams as a user. The actual expansion of the list will be done by Mailman and therefore, that is irrelevant of Xeams.