If your company is audited for compliance of software license usage then you will be found in breach if you have more enabled CRM user accounts than you have purchased CALs for.
You'll need to purchase a server license for every server on which you install CRM Server (including production and non-production servers), but once a user is licensed they can access CRM in any environment.