Q: "does this mean that we need to have an over current protection not exceeding that, or only load that is not to exceed that?"
A: Since the wire is now only rated for 15A, the OCPD cannot exceed 15A. (that's why we try not to put the 10th current carrier in the pipe)
Q: "Say for example we have a lighting circuit with a load of 5 amps, is this ok with at 20 amp breaker?"
A: Sure, as long as the conductors are good for 20. In this case you have some extra capacity on that ckt for future use.
Q: "say we have 2 15A convenience outlets on one circuit, this one to me seems that it shouldn't be ok since someone could exceed the 15 amps for deration, but it would not trip the breaker."
A: If the derating lowered our ampacity to 15 and we put a 15A breaker on the ckt we're fine. If the derating lowered our ampacity to 15 and we put a 20 on it ... we have a prob. The 15A breaker will prevent the wires from carrying too much amperage and becoming overheated.
Q: "The case that seems pretty clear to me that’s not allowed is a dedicated 20A outlet on a 20A circuit. Since it would be easy to exceed the deration?"
A: If it is a true 20A ckt(meaning the conductors and breaker are rated 20 amps after all derating) you're ok with a single or duplex 20A receptacle. If it should be a 15A ckt after derating (even though it has #12 THHN) then a 20A receptacle is not allowed (but a 15A single or duplex is).

Hope this helps