It's actually easy. Inside a company, you buy CALs. If the people are authenticated users, Windows Auth, or just AD accounts, they should use CALs. Per processor is for unauthenticated users, primarily Internet ones.