Do both client and server need to implement OpenSSL protections to protect from CBC attacks
Yes, both the client and the server must have this mechanism enabled to get full protection from BEAST and similar attacks.

In particular, if the client is a browser with scripting capabilities, it is the client side implementation that must send empty packets before each content packet. Enabling this feature server side only, just means that the server will send such empty packets. This will provide no protection from script based attacks against browsers.