Business Pack license is required for developers who write or edit code that relies on the code distributed in the Business Pack package.
If the other team members do not edit code using Business Pack or build the project, they do not need a separate license.
In your case, you will need 2 licenses for the people directly working with the project.
The other 3 people do not need a license if they do not need to edit or build the project - for example, they can have it unloaded in Visual Studio or disable building it in the Configuration Manager window. That way, they shouldn’t even need the DotVVM Private NuGet Feed.
CI servers can use any developer’s account to get the packages from DotVVM Private NuGet Feed. They do not need a separate license.