A CAL for SBS is needed for each actual user OR device that will connect. Up to 75 by default. However, you can store as many as you'd like in AD as long as your CALs allow for the number of connections necessary.
-You have 25 CALs
You can put 100 user accounts in AD, but only 25 connections to AD/SBS will be allowed by your CAL licensing at a given time.
Assigning a License. To assign a
license means simply to designate that
license to one device or user.
That says "physical device or physical user" not user accounts in AD. That means I can have TheCleaner1, TheCleaner2, TheCleaner3, TheCleaner*N* as accounts in AD but I can log in as any of them if I wanted to...however I can only log in to one of those accounts at any given time if I'm using a "user CAL". If I'm using a "device CAL" then I can physically go to X number of devices and log into AD with any of those accounts (where X is based on the # of device CALs I own).
See here: http://blogs.msdn.com/mssmallbiz/archive/2006/04/19/579256.aspx
It's definitely not something that seems to be spelled out in pure black and white though.
For me, device CALs have always been the simpler approach. I also believe that Microsoft wants you to understand the "intent" of the licensing and not get wrapped up too much in it...I talked with my own MVLS contact and their own answer was "just buy a device CAL for each computer and call it a day".