This is an all too common scenario within the corporate world. I have to deal with exactly this problem and it isn't easy. The apps are business critical and cannot be replaced (last replacement implementation project came in at $15 million). There are firewalls and other layers of protection, but these are PCs used by staff who will also surf the web and could easily connect to a site with malicious java based applets.
All you can do is try to implement some controls to reduce the risk. As suggested, whitelists and java security policies can help. However, don't overlook education. Run an information campaign that informs your users about the security threats, how to spot them and what to do should they suspect they have possible been compromised. Ensure people feel OK about putting their hand up and saying "I think I may have made a mistake....". Use intrusion detection, log analysis and network monitoring techniques to alert you to problems sooner rather than later. Above all, assess your users and identify the risk profiles so that ou know where you are most exposed and where you need the stronger controls and review regularly.
finally, ignore any advice which talks in absolute terms, There are NO absolutes in IT security. You are not definitely screwed nor are you definitely protected. The threat differs depending on who and where you are and what value you represent. What you do to protect yourself should be a reflection of the threat exposure.
Of course, in my perfect world, the three amigos (Java, Flash and IE) just don't exist and all my users have perfect awareness!