You need an NGTX license on every gateway that is "extracting" the file, which means:
- If extracting files from the stream off HTTP/SMTP traffic running through the gateway, you need the license on this gateway
- If using MTA then on the gateway running the MTA
- If using ICAP then on the gateway running the ICAP server
You don't need an NGTX license on the device doing the emulation.
But if you are having MTA or ICAP running on the TE appliance directly, then it would need the NGTX license there.
Hopefully I could describe it understandable for you.
Regarding Management: TE appliances are handled like normal gateways, so yes it takes up one gateway of your licenses.