If you only want them to be able to GET files through a web site, that is easy. You just turn on the FTP site in IIS manager and then write links to the FTP root in the web pages that need them. The address to the ftp site would be ftp://www.somecompany.com, instead of http://. Web browsers these days can automatically switch in to ftp mode. It is more efficient at transferring files than http. If there is a firewall involved, then you need to have the ftp protocol enabled to the server. Usually ports 20 and 21. You also need to be careful about the authentication method you choose. Anonymous is usualy best, as it doesn't require users to transmit their username / password to the server. FTP by default transmits these in the clear. Bad, for sercurity.
If they want to PUT files on to the server, then you have to start thinking a little harder. They either have to use a FTP software or you have to write special components for your web pages to handle the transfers. WS_Ftp is a nice program for this. Also, for uploads, isolate the upload directory on its own drive, away from the system files and OS. This will prevent types of Denial Of Service attacks. The attack is as simple as uploading files until the harddrive is full. The OS runs out of space and crashes. If your using Win 2000. You can use a disk quota to do the same thing. (If you have your web root and ftp root on the system drive, you are already in a lot of trouble. Think directory traversal.)
If you get more specific about what your users would like to do, I might be able to give you more precise instructions. I hope this got you on the right track though.
