Email SPAM filtering

I’m looking for recommendations on SPAM filtering for a small business (law firm) using Exchange 2K/Outlook XP for email. Not sure whether it would be best to go with filtering at the gateway/server level or using client-level software. I’d appreciate any recommendations of which way to go and any specific software experiences or recommendations. Thanks!