This is a really confusing topic, even if you try to look up what it means to Microsoft IIS or Netscape or Groupwise. This is how I understand it (have a lawyer review Lotus' CAL documentation if you need to confirm):
The web CAL is only for direct intranet/extranet users, i.e. users who have a very close relationship with your company. Examples would be your company inventory app that distributors use to collaborate w/ you. Another example is if your employees acces their HR records over the web.
For Internet users who are logging in to participate in discussion forums on your site, there is no charge because they are not directly related to your company.
Note that most people think IIS is free. IIS itself is free, but usually you need a back end database since IIS does not have a built-in DB; this is where Microsoft gets you to pay more for buying and using SQL Server. For RDBMS CALs, the only way to get around them is to use one RDBMS login for everything and then use appropriate SELECT statements to mask data for each user. Once you start adding real DB username/passwords, you are also subject to CALs for the RDBMS. Note that you will be able to use this same technique in Notes R5 since it supports sessions.
Note: apparently, the CAL policy was changed sometime in March, 1999. The above description applies to CALs from last year. The current CAL policy as written seems to say that you need a CAL for any authenticated user (even if not an employee or distributor) unless you want to spend $25K on a Server Access License. This is patently stupid. This FAQ will be rewritten as soon as I can figure out what the new policy really means. Sorry for any confusion the previous FAQ may have caused. The direct link to Lotus' CAL information is http://www.lotus.com/dominocal.