You're correct; the capabilities object currently does not convey that sort of information. The intent of the capabilities object is to describe the structure of the POST request; it wasn't intended to show implementation specific restrictions on how things can be composed. Currently this would require the client to try a composition request, see it fail, and modify the request as the service indicates. I'll bring this up for discussion within the group to see if there's a better solution.
Within a ResourceZone you can use any ResourceBlock any number of times based on below steps. 1. If CompositionState=Unused or 2. If CompositionState=Composed, then look for SharingEnabled=true && NumberOfCompositions <= MaxCompositions.
That gives user an indirect control on how many RB's to include in his Composition request. Note even if Capabilities define how many Storage RB's you can include, the client would still have to work through the above Attributes to identify if its free and shared.