I don't know exactly what you get from a Zone Alarm account, or exactly which capabilities the Sophos firewalls you've been recommended have, so I'm going to keep this pretty generic.
It sounds like you want to have two different networks, one "guest" network and one "employees" network. You don't say whether users who are legitimately on the employees network should be able to access devices on the guest network, but you do have concerns with users on the guest network gaining access to devices on the employee network.
This is actually a pretty easy scenario to solve.
First, you'll want a reasonably secure configuration on each computer in the employee network. Thankfully, modern operating systems are pretty reasonable in this regard, so you might be able to get away with simply a basic, no-frills installation with default settings. Make sure they are set up to apply patches in a timely manner. A host-based software firewall and antivirus software can augment this to great effect. Good passwords help, too. This is nothing fancy at all, just basic computer hygiene.
Second, you want to isolate hosts on the guest network from the employee network. There are basically two ways to do this.
The first option for creating two such isolated networks, and the one I'd probably prefer, is to buy two "small or medium business" NAT routers from your preferred vendor. I'd stay away from the home user ones, as they might not be able to deal well with the loads imposed by a somewhat large number of clients, but you definitely don't need the high-end stuff. Depending on which ones you choose, this will likely set you back up to a few hundred euros apiece. Set the two routers up in (electrical) parallel. Configure one to serve your employee network, and the other to serve your guest network. Connect both routers' upstream (WAN) port to the LAN side of whatever gives you Internet connectivity. Done. The normal firewalling and NAT functionality will serve to isolate the networks from each other in the same manner that the local network is isolated from the Internet. You can punch a hole from the employee network to the guest network if you want to, for administration purposes, but that should be it as far as any special configuration is concerned.
The second option, which relies somewhat on clients being at least somewhat cooperative, is to use VLAN (virtual LAN, typically 802.1Q) functionality. In this configuration, you'll use only one router that joins both networks, but it will need to support multiple VLANs with VLAN isolation. Assuming that owners of guest devices aren't going to want to mess with VLAN settings, and set up the default VLAN to be the guest network. Set the guest VLAN to be isolated from everything else. For the employee network, set up a separate VLAN confined to the systems that should use it, either port-based or via something like 802.1X. It might be possible to do this with a WiFi router that offers multiple wireless networks, but you'll need to make sure they are properly isolated from each other, and it'll likely give you the downsides of being stuck on a shared WiFi, including throughput limitations. Either way, the mechanics of how to do this will depend very much on the specific router and its capabilities.
The second option is more flexible, especially if used with authentication-based VLANs or other generic client-based authentication, since this would allow any properly authenticated device to join the employee network. However, it's more complex to set up, and much more opaque in the way it works. The first option requires either another NAT router in front of the two, or that your ISP provides you with multiple IP addresses (which is not a given), but rather than requiring networking expertise and an in-depth analysis of the router configuration, you can simply look at the cables and see how things fit together and how data can physically flow, then apply the normal reasoning of more or less just "WAN = potentially dangerous; LAN = assumed safe".
With this in place, chances are pretty good that the employee network devices will be unreachable by guest users via normal means, thus greatly reducing the attack surface via the guest network. The protections on each host in the employee network will further serve to stop anything that does manage to get through. This likely won't stop a truly determined attacker who has set their mind on getting into your network specifically, but most attackers don't care about you or your data! They care about easy pickings. Make your network somewhat unpalatable to the attacker, and you have dramatically reduced the odds of a non-targeted break-in or malware outbreak.
It's much the same as in the physical world: a good lock doesn't stop someone from breaking a window, and an alarm system doesn't stop someone from pointing a gun at you and telling you to turn it off. However, both increase resistance. Sometimes, making the attacker's job more difficult is sufficient to keep them from succeeding.
