Enforcing acceptable use on individual machines is the way to go. This means making sure that users cannot tamper with client antivirus software. With a knowledge of how the network should run, you can see what software and hardware you will need. This will help with configuration as you'll know what you hope to achieve by installing a firewall in the first place. With a security policy in place, it's time to turn your attention to the firewall, which can be notoriously difficult to tame.
Careful installation is needed.
This receives protection from the firewall in the same way as that of the internal network, but is firewalled from the network as well. Even if a machine sitting on a DMZ is breached, it can't touch the internal network. This makes a DMZ ideal for protecting machines such as web servers that need to be externally visible. Many firewall vendors now provide support for multiple network cards, which is especially useful for creating multiple DMZs. Externally visible machines can be spread across these zones, and for each machine that falls under attack, the others remain protected.