If you are running a public website using the SQL Server as a backend, you need to use Per Core licensing (or Per Processor licensing prior to SQL Server 2012). With this license, you do not need any CALs.
If you are saying you have an internal web application being used by 20 users, then you have several options and you'll have to figure out which is cheapest (keeping in mind future growth).
You can choose the Per Core licensing as described above and all your licensing needs will be met. Note, you need one license per processor core on your server. You did not specify how many cores your system has. If you have a backup server for fail-over, you will need additional licenses for that as well.
Alternatively, you can choose the Server+CAL model, which is the more confusing approach. First, you'll need a server license. Then, you have to determine how many "users" you have. For this purpose, a "user" is either a specific person (user) or a specific machine (device). You will need one CAL for each "user". If either the machine or the person logged in at the machine has a CAL license, they may use the SQL Server for any purpose, whether it be SSRS, SSIS, a web application, or whatever.
If you have backend systems (servers not being used by a person) that need to connect to the SQL Server to perform automated data imports or any such thing, those systems will need device CALs. If you have a traveling sales-person who needs to use the web app from anywhere, that person will need a user CAL. If you have typical cubicle employees, you can license their machine with a device CAL, or you can license the employee with a user CAL, it's up to you.
Edit: You'll also need a Windows Server license of course. I think that's obvious, but you never know...