Hi Dave,
Microsoft generally recomed that you have a front-end back-end server topology, (i.e. that you have a stripped down server that connects to the internet and a backend server that actually holds the Information Store. This is used to prevent DoS Attacks, although Exchange will work fine without it.
I would recomend having at least one firewall in place, i.e. firewall - front-end - backend or firewall - front-end - firewall - backend.
Keep your Anti-virus software up to date.
Microsoft have an application called ExBPA that checks Exchange to see if it configured to the best practice recomendations.
Hope this helps,
chuck.