If you need web browsing you can set up a filtered proxy server. If you need email, you can set up an internal SMTP server.
That is the way most businesses handle it.
That's what we do. We also use firewalls. Malware still sometimes gets through via Internet Explorer.