A company runs a web site on Windows Server 2008 Standard. The web site contains several ASP.NET applications running under Anonymous Authentication (default for IIS). The applications are visited by a few dozen users on the Internet, outside of the LAN.

How many CALs and what kind -- User or Device -- have to be installed on the server for not to be chased by the Microsoft for license violations?