we intend to build a network in a small health center with No Internet Access
it is expected to have 30 terminal machines, all machines will use an electronic medical record web application
we want to "hide" the application behind firewall
Updated to take into account the zero Internet Access:
As you have mentioned, the switch can be configured to route the ISA server to segregate the application from the users. It looks from your model you are expecting the ISA to run a public and private VLAN through its connection to the switch.
More typically having a dual homed firewall is considered more secure, as traffic on each network is physically separated by the firewall. But basically the app server will connect to the ISA on a network port for the 'protected' side, and a network port on the 'user' side of the ISA will connect to the switch.
You can obviously use access control lists in the switch to provide further controls, however this may be all you need in terms of infrastructure.
One risk to look at is how likely a PC is to be attacked in your environment. Are they left unattended? And unlocked? Your infrastructure may then not be sufficient.
edited to say - if medical/personal data is on the server, and you are in a country with strong regulations in this area you may need to use stronger controls.
Can the terminal machines communicate with each other? There might be a risk of one terminal monitoring communication of another one. There are two user accounts so there must be segregated data. The switch helps mitigate this but it can be defeated.
How hard is it to hook a little pocket wifi router into the ethernet cable connected to the back of the terminals? That would give someone remote access to spend time attacking.