A 10-user TZ-170 will only support only tunnel, but can support multiple external connections via the VPN software client. Those clients connect via the Group VPN. When it states "tunnel", think in terms of a device-to-device connection, ie: one office connecting to another office via a pair of SonicWalls. The TZ170/10 will support 10 users behind it (in the office) as well as up to 5 remote clients. The TZ170/10 includes no Global VPN client licences- you need to buy them separately, they're about 45-50 buck a piece. You need a license for each remote client connection. Each potential external client doesn't need them- you can load the GVPN software on as many remote machines as you want, but you'll need as many licenses for the amount you want to allow to connect concurrently.
The TZ170/25 supports up to 10 tunnels, and up to 50 additional remote client connections.
As Johnny9 pointed out, the 10/25 refers to clients behind the firewall. Don't forget to include servers in the count.