The license itself is only installable to one BE server as far as I know.
Correct, the serial itself is only installed on the media server. You can locally install the AOFO code on as many machines as you wish, but don't let an Auditor catch you doing it.
Veritas and now Symantec are very clear that AOFO (just like all the other agents, RAWS, SQL, Exchange, etc) is one serial per server protected.