As many as you want, but then again, you're probably asking the wrong question. First of all, with a web-based application, the client operating system is irrelevant. Given that, each client can make a call to your HR application through their browser of choice and should, most likely, acquire the home page of the application. What is important here is that when the user has the HR home page in their browser, they are no longer connected to your server. The only thing that remains on the server is that user's session which is controlled by the cookie that your application placed on their computer.
So, I guess my question is: What is your concerns regarding the number of clients accessing your web application (and all other implications associated with using a SQL Server database)?