You can certainly use agent based backup without an ESXi license requirement. The license is only required in case you need to unlock the API or your host has more than 32GB of physical memory.
For small environments like yours, I'd suggest you handle antivirus as ion physical Windows machines. Regarding backup, it depends on your needs (SLAs, time to recover, ...) how you do your backup. I don't want to sound like a salesman, but I would probably purchase an an Essentials Kit along with Veeam Essentials!? And since this is a single host environment, I'd also make sure to have the required support for the hardware (e.g. 13x5, 4h Onsite)
André