You DO NOT need a CAL for every user, unless you know how many users (exactly) will need to access the server. For instance, if it's a team of 5 or 10 internal users, you would need 10 cals.
But if it's a public server, and you do NOT know how many users will hit the website, you required a "PER PROC" license. You would need a per proc license for each CPU in your server. If you have 2 CPU's, you can either use 1 or 2 proc's to run MSSQL, but if you wanted to use both, then you need 2 per proc licenses.
Hope this helps.