2 physical servers are enough for full HA, if you believe your network is robust enough. Otherwise you need additional small physical server for cluster arbitration - to avoid split brain in case of network connection lost between data nodes.
The default and recommended number of replicas is 2, it means given data is stored on two nodes: the "main" one and the "backup" one. See https://dev.mysql.com/doc/refman/5.6/en/mysql-cluster-ndbd-definition.html#ndbparam-ndbd-noofreplicas for details.
