It depends on your deployment. If you use Windows Authentication, then 1 CAL is used per user. If you use Anonymous Authentication, then it does not.