How do the parts fit together?

The three main elements are resources, permission sets and accounts. 

Resources define the content that you have subscriptions for. Your resources will be a sub-set of all the ones in the catalogue. They are collected in your permission sets, which identify the resources that your accounts can use. Accounts identify the user as being one of yours and covered by your subscription.

A simple set-up where everyone has access to everything needs only one permission set. It would be set as a default permission set so that all new accounts get it. 

If you have different types of users, you can create more permission sets. A common approach is to put the resources that everyone can access in a default permission set, and use extra permission sets for the special cases.