@Alan1 if you have 2x WAN links per spoke and 400 branches along with 2x hubs then yes, you will have 400x2x2 + 1x between each hub, so a little over 1,600 tunnels.
If you want to run them in Azure then the largest hub support 250 tunnels and 500Mb/s of throughput so you would need 7 by my count as they don't have to be in pairs.
If you can run them in AWS then you only need 2x large vMXs, might be worth asking your sales rep if there is any data on when the large is coming to Azure. This also applies to a pair of MX250 physical MXs which you could then possibly express-route to Azure?
@Alan1, if you're only looking for a failover solution on the SD-WAN solution, not active-active tunnels, then you could set the 'Active-Active AutoVPN' setting under 'Security & SD-WAN' to Disabled. This way a tunnel isn't built on the secondary link from the branches unless the primary fails, so halving the requirements.