The front end servers used to host your website would generally be considered as running “web workloads” and CALs or External Connectors will not be required to access these servers. Once the customer adds a widget to their shopping cart, creates an account and enters their credit card and shipping information to complete the sale – they are now authenticated via your back end commerce servers/application (non-web workload). Since users are accessing the backend commerce servers which web workloads are not running – CALs or External Connectors will be required for users to access these back end servers.
I thought this would be obvious, since Server + CAL Licensing would make any public site unfeasible, and there are many large sites running on the windows stack.
Also I read some Ms documentation that a windows server that runs the database for web workloads may acutally come under web workload. I can't remember that document however.