An IIS server would probably be considered multiplexing, yes. It would also be considered multiplexing if it was an internal only intranet site as well. What they don't want is to have 1,000 people all accessing SQL Server through a web interface on a single CAL.
Device licensing would be used if say you had a single terminal at a department used to access the server, even if many people used that terminal. Rather than giving each user their own CAL, a single one would suffice.
All this is really just academic though. If you want to be properly licensed for an internet server, you need a per processor license.