For the most part it is correct, but there are some details omitted.
Messages are pushed from the broker to MassTransit. The prefetch count is the number of unacknowledged messages which are allowed to be pushed to MassTransit. When the prefetch count is reached, the broker will stop pushing messages until one or more messages are acknowledged.
The concurrency limit works by using a semaphore to limit access to the consumer to a number of concurrent tasks.
With a saga, using a database with pessimistic locks, you can do the same thing since the lock in the database will prevent two instances from running at the same time if they have the same CorrelationId specified. If you are seeing locks or deadlocks, you can use the PreInsert and saga factory to build and save your saga instance prior to the first event being processed by it. This will do a true insert instead of a select/lock/insert which is better when using a serializable isolation level - which is required for proper locking.
The concurrency limit is per receive endpoint, so if you have two machines running the same service on the same queue, you'll need to use database level locking or some other strategy to limit concurrency per saga instance to one.