Configuring the firstarrival limit to 1 for dynamic MAC Locking means that: 

Only the first end system using that port will ever be allowed to use that port unless the MACLocking state for the port is reset by the network administrator 

A static MAC address for MAC Locking must be set 

A users MAC address is locked to one port and thus will not be able to use other ports on the network 

Only one MAC address at a time will be permitted to use the port