A roll out of a complete OS? Are you running AD? There are a few questions here.
If you are just patching systems that are currently in place, you can force the upgrade and then use group policies to manage your clients who have obtained the upgrade. All the options for firewall, popup blocker, windows update, etc... are available wthin the administrative templates of the group policy utility. You can also push an 'adm' file to your clients after you've made the appropriate adjustments on a mock workstation.
Here is some propaganda from the MS machine...
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/mangxpsp2/mngdepgp.mspx
There are a few tut's for apply sp2 GP templates with the sp2 rollout.