As long as your policies are set correctly (not that this is particularly easy), your project will only need a version of CMake or newer, not a specific version.
Yeah, they are quite good at compatibility. In practice there may often be an upper version limit if you happen to use any features which eventually get deprecated or removed.