About connections:
The <max_clients> configuration element was introduced as a protection from overload, hence it is just a limit on the overall number of sockets currently open.
This may depend on implementation details. For instance, control connections used for subscription requests are also included (hence, multiple connections are possible for a user).
So, the setting is not meant as a limit on sessions and there is no guarantee on the number of concurrent sessions that can be reached.
The setting will be deprecated in the next minor upgrade of Lightstreamer, where a <session> element will be finally introduced.

About subscribed items:
A limit on the subscriptions can be applied by the Metadata Adapter, by implementing notifyNewTables, notifyTablesClose and wantsTablesNotification properly.
By throwing a CreditsException you can refuse the subscription of a new table. This applies to the whole table; you cannot accept only a subset of the involved items.
The client is notified of the refusal. For instance, a web client gets an invocation of the onServerDeny callback with a 0 or negative error code.
Note: notifyNewTables takes an array of tables, but you should expect only one table; only particular clients submit atomic requests for multiple tables.