Placing these servers directly on your internal network and allowing incoming connections to them would be a bad idea. If an attacker breaks into a service, they would then have free run of your network. Of course, these policies must be kept up to date and properly installed on firewalls in order to be effective. Here we arrive at the next set of relatively fundamental issues. To process, store and present data.
People build computer networks so that many people can access resources and get work done.
Of course, these people want to move all sorts of data around, everything from articles about security to animations of dancing babies. If attackers can connect to ports 137 to 139, they will be highly likely to find a poorly configured Windows machine with network shares, and exploit it. The answer is to block incoming access to ports 137 to 139. Because of weaknesses in Microsoft's TCP stack, connections to port 135 can also benefit an attacker. Again the answer is to block incoming data to port 135.