Laura,
 
Virus, adware, malware, etc. protection and insulation is the NUMBER ONE problem facing systems administrators today....period.
 
Would your server be vulnerable? Yes. Same as everyone else's is. The best you can do today to provide open and useable access to users while still maintaining reasonable security is to layer your protection.
 
Perimeter protection is your firewall to the server. Behind this you have your AV and spam protection. Behind that is your Active Directory (AD) policy control. Behind that is your adware, malware and related.
 
Beyond this, you HAVE to make sure you have appropriate use policies and that they are published, distributed, signed-off, and enforced.
 
By doing these things you will then be as safe as anyone else out there.
 
My 2 cents...

I appreciate Lorne's comments and feel they nicely convey a solid strategy for internet security for a small firm.
 
Yes, connecting to the internet is risky, but so is driving to work in the morning.  It's a measured risk and you have to weigh the benefits.  
 
We have 10 users and I allow 5 of them access, using roughly the protections that Lorne listed.  In four years, I have never had any down time or performance issues related to this.  Our usage policy is clear and I monitor and enforce it.
 
The benefits of access for us, e-commerce, research, procurement and communication with customers and vendors, far outweigh the risks.
 
I'd plug it in and hire an IT guy to tweak things for best security.  You'll wonder why you didn't do it years ago.