I've had the pleasure of negotiating an EA for my of my customers. It's been 5 or 6 years, but I'll try to help.
You can use either device or user CALs depending on what you need. The CALs are independent of how many servers or whether you're running in a VM.
If you have 25 devices and less than 25 people, you would likely go with user CALs (e.g. 10 people using 25 different computers would only require 10 user licenses). The opposite applies as well (e.g. 40 people using 25 devices, you'd get just the 25 device CALs).
The server licensing is an interesting and separate consideration. I'm pretty sure that if a server is used for DR/BCP then you don't need separate licenses for it. Just the primary active servers need licenses. On the other hand, if you're distributing the workload across several servers, you'd need all of them to be licensed. I don't think this is the case for you.
Any particular reason you're planning on using VMs? It's not a bad idea, just wanted to understand the drivers.