Firstly, you would be surprised how many TCP/UDP ports are deliberately left open on routers and PCs regardless of most firewall settings; so as to allow basic operating system network services. If you connect outward from your computer, a network interface is enabled - which results in accepting certain unsolicited incoming packets to maintain that network (DHCP, ARP, etc).
Keep in mind that the 'phoning home' behaviour of many modern apps requires you to either block their outgoing traffic or trust the third-party servers of each application. This includes applications that you usually install and keep up-to-date to have a minimum feature-set on a normal computer (office tools, image editors, browsers, etc).
Usually computers within a local area network of a business are trusted with robust but reasonable router and firewall configurations. After all, if you don't your employees you have an entirely separate problem.
So to answer your question - if you want your business computers to talk to each other they will never be 100% secure (no air gap). But basic principles of browsing/email hygiene, routine anti-virus, routine backups, properly configured routers and encryption of important files will cover most high-risk scenarios.
If you do only one thing for security purposes - get a decent backup solution in place that you use. As data theft with untrusted employees is a much harder problem and deserving of an entire book or hiring a specialist.