The objective really depends on what trade-off between efficiency/productivity and security you're willing to make.
Stopping general phising (the mass mail, badly written, generic kind) is't impossible, and can be achieved without too much sacrifice, through proper employee training. Highly targeted, professional grade phising though, is incredibly hard to stop, as it may appear to be from (or be from) legitimate email accounts, be well written and highly relevant to the person receiving it. I would say stopping this kind of attack is near impossible for any organization that relies on interaction with the outside world.
There have been some examples of these attacks recently (against people who most likely do have employee training):
Of course training employees to exhibit "proper" behavior requires the proper internal organization to support it. There's not much point in telling employees not to do something that will actually be required of them (for example clicking links to change their user details, etc).
The average person can first of all be highly critical of any email received.
- Does the email use properly constructed English?
- Is this email something you asked for or were expecting?
- Would an email purporting to be from paypal or your bank ask you to follow a link to wallyswatersking.com/wp-content/acdasdc.php? Note that links that appear to go to certain places may not (can often be detected by hovering the mouse over the link, or by examining the source code of the email).
- If an email has an attachment, is it from someone you know? If not, it's probably a very bad idea to open it.
Technical solutions to mitigate these problems might include
- Up to date AV (although this will likely not be effective in targeted attacks).
- Application sandboxing.
- Using an email provider that actively works against phishing and spam (like Google or Microsoft).
More on phishing here