I was wrong. Sig set me straight:
“You don't need Windows CALs for each connection if you, like me, make the site available for anonymous access and use WSS and not SPS. Only SPS needs an "External Connector" license AFAIK. But then, I'm not a licensing expert ;-)“
Thanks, Sig!