Best system to manage internet security for 2 groups of users

I need to configure a small network with 3 categories of users:  superusers, office, and public.
All run windows XP or Server 2003+; superusers (admins) can do anything, office can access anything on the internet and files on a windows fileserver with the right security,  public stations can only access designated websites, and network or local printers. Also public stations should be totally isolated from the office network. Having remote access to the internal network from the outside would be good. Finally some special needs are that one workstation needs to be reachable as fixed IP on port 80 (which the Netgear does well enough).

What would be a good recommended configuration? See below for current ideas.

Until we decide on a more robust configuration,  we're using a Netgear firewall, openDNS and two separate ISP 's to achieve the above. All computers including the workstations are on the same segment as the other machines for ease of setup.  This system would nearly work well enough except that OpenDNS only blocks by a whole set of categories so the block is not comprehensive. Is there a paid service that would provide this blocking /filtering. We would prefer to have strong enforcement, so even if users succeed in changing network settings (which they shouldnt...) they still wouldnt be able to access an unauthorized DNS provider.

Another approach would be to upgrade to a Sonicwall or Watchguard firewall appliance - the one drawback is the yearly maintenance fee of about $500.

Setting up a *nix box to do the routing /firewalling would be daunting unless it were available pre-packaged.

Using windows server 2003 (or 2007) - would that be possible / recommended?  I'm not too confident in their security..  But happy to hear what solutions are available.