My experience only, talk to a seller for the real deal.
You need to pay for authenticated access to the server no matter how you connect or how the apps are presented (client, web, xpages, pure html, whatever). You can do that by person or by server but typically the 'by server' option only makes sense for larger organizations. If you allow unauthenticated access, then you typically don't need to pay for CALs but then you have no way to know who's doing what and there is no way to use ACLs/Roles to manage design elements.
If the clients are outright owned, then they're good forever but you don't get upgrades. If you're OK running at version old.old, you're good. If they don't own the clients, then they need to either keep paying for licenses or buy a set.
Server costs depend on PVUs and if you're on a VM or physical machine and VMs make the whole thing a cluster fck...tread lightly if you go that way.