A domain is far easier to manage than a workgroup. I prefer Windows Server 2003 over any other network operating system because of familiarity, ease of use, and the wealth of information available by users, forums, and experts. It's also relatively cheap. I know a company that has Standard Edition running on their domain controllers for a network of about 5000 users. Of course, you would have to buy a lot of CALs for that number.
The design really depends on what the singularity of your network requirements. Are we talking about 5 users, 25 users, or 100 users. Also, knowing that the users are web developers, are they going to be using any Macs? That may complicate your domain setup.
A star topology is a good choice for any decent size network, in which every workstation gets their own dedicated line from a switch. We are a Dell shop and EVERY computer is a Dell. All workstations except mine are running Windows XP Professional.
I don't know your Internet needs but a dedicated T1 gives you a guarantee that you are not sharing bandwidth with other companies and gives you more bandwidth anyway, although fiber optic speeds are faster.
For remote access, we use Logmein. It's convenient, based on email addresses, and better yet, free. You can set up a Logmein account for an email address and associate one computer per email address. However, there is no limit to the number of domain email accounts you can use, meaning we have 40 work email accounts set up, name@work.com. Each email account is set up with a Logmein account with that person's workstation as the one free computer for that account. If I need access to someone's computer, I go to the Logmein site, enter that person's email and remote into the computer. There are pay accounts, but the free stuff has really no restrictions: ie. network share access, printing, etc. Better still, you save your bosses a lot of money.
Security...do you mean a physical firewall device or antivirus software? We have Norton AntiVirus on all our workstations. Our firewall router is a Sonicwall Pro 3060. It has a DMZ port for web hosting and email and has VPN capabilities if we ever want it.
Hope that helps a little.
