First: I have to let you know that 1, single Anti-Virus definition set(from a single vendor) is not a "One Stop Shop," because they each are individual companies, some more proactive than others but eventually all viruses will be covered. Unfortunately due to legal and ethical issues, they can't check everyones computers to see whats floating around as the latest and greatest virus.
The difficulty is that they all have different techniques and approaches to scanning for viruses.
Second: Patches must be current, policies must prevent downloads of particular files. If your organization uses internally sourced email, I recommend purchasing a deal with a company like MXlogic/McAfee for scanning emails, as well as the desktop AV source. With bulk amounts of mailboxes, you could get a price like $3 per user. They also offer business continuity, so if your email server goes down, they will store your email on their servers until it's back up. With that, end-users can also check, as well as send/receive emails on their web portal, until the email server is back up. Once the email server is back up, it forwards all of the email to the server.
Personally, I have always liked ZoneAlarm, it has administrative password protection to prevent changes. Changes can't be made without the password. It's very customizable, you can configure it to reduce CPU usage for scanning Viruses and Spyware.
It also uses a virtualized web browser, so if the browser does catch something, it can be dumped and never reach the kernel of your operating systems. The browser feature is called "ZoneAlarm Forcefield."
Right now they have a killer deal, $39.95 for 1 Year License that can be used on 3 Computers.
ZoneAlarm used to be a freeware firewall software until it was adopted and backed by Checkpoint Software Technologies Incorporated. It was one of the first few original software firewalls... The same individuals whom make enterprise level appliance devices for secured networking. They have also been in business for over 25 years now.
http://www.zonealarm.com
Check it out, I have 3x3 licenses for my systems at home. They also have an "End-Point" security solution directly with http://www.Checkpoint.com. Which is a centrally managed Zone Alarm like product. Zone Alarm by itself has to be manually configured. Checkpoint Endpoint Security is centrally configured for all hosts with the security software. Kind of like ForeFront Security, Trend Micro Office Security, or other endpoint security vendors. It's a little on the pricier side of course, but it's intended for companies with many systems that require an endpoint security solution. 3 computers, is good enough for home edition security like ZoneAlarm.