Hi Mike,

Unfortunately you may not be able to purchase the upgrade license as clearly indicated by Halijenn's link. You may however be able to wokr around it , based on your current requirements and/or budget. If you cannot proceed with the upgrade path to ASA at this time you could perhaps purchase an already used pix501  that has unlimited user license,  possibly for couple of hundred dollars on eBay or other used equipment providers, just google its part number PIX-501-UL-BUN-K9 and see what you could find, then simply cutover the existing configuration, this is a last resort option if a license no longer feasable or unable to upgrade to ASA firewall to overcome that user limitation. Another option may be to use and internal proxy server and have your users point to the proxy for internet, personally I have not experiment this scenario with proxy server but have come across past threads by folks successfully done it without upgrade of user license..I must say ,  here I cannot realy help much.

If your budget permits, consider upgrading your PIX501 with an  ASA5505 , and if you could afford between $600-to-$900 use a ASA5505 with Security Plus license, part number ASA5505-SEC-BUN-K9, and utilized numerous great features PIX 6.x code would never support such as webvpn , be able to use AIP ->Intrution prevention   or Content filtering  module etc.

.

See ASA5505 table for some of its  features specs
http://www.cisco.com/en/US/partner/products/ps6120/prod_models_comparison.html

 
See Table 13 for ASA5505  License specs
http://www.cisco.com/en/US/partner/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet0900aecd802930c5.html

Good luck

Rgds