Enterprise FTP Access thru Firewall

I need to provide ftp access on the desktop so users can download files, SPs etc., with FTP protocol being allowed thru the checkpoint firewall. I am looking for suggestions to implement access control (who can use FTP) as well as prevent ftp upload(data going out) as well as content security such as virus check. How is this being handled by large organizations. We allow about 20000 users browse access to the net, but only about 200 needs ftp access from the desktop. Do you use client software such as WS_FTP? We are using MS Proxy but will upgrade to ISA server soon. Appreciate all observations or comments in this regard.