1 CAL allows 1 client to use the services of the Server.
There are two types of CALs to be purchased
User CAL which allows one User to use the services of the server with all his devices.
Device CAL which allows one device to use the services of the server, no matter who or how many users who use the device.
One example of this would be a kiosk machine or similar which can be used by anyone who walks by.
So this might be a question on how you define who accesses the server, but as I see it, the Sinology server is using the services of the Microsoft Server and the users is using the services of the Synology server, which means you would need one device CAL to legaly use the services of the windows server in this setup.
-Nesvik