Network needs added segment – advice

Our current network is rather simple. A DSL internet connection into a Smoothwall (Linux) firewall, which serves approx. 20 users on a NT4.0 server.
The accounting department is updating software and needs an independent network with a VPN connection to the internet(for remote users-2).
I can add VPN capabilities to the firewall. I would like to keep one internet connection for both networks. What is required to have both networks served by one internet connection? It would be desirable for the accounting department to access the main network, but the accounting network must not be accessible from the main network. The accounting network will have a W2K server.