WSS comes free with Windows Server 2003, but you must have the appropriate licensing for your users. This means if you want a public WSS site every user that will access it must have a CAL associated with their domain account. I'm pretty sure you are doing an internal site that is going to be externally accessible, so that won't be an issue.
On the other hand, DMZ for WSS is a bad choice. A good rule of thumb is that if it uses AD authentication it should not be in the DMZ. For that you would use another authentication provider or an extranet domain. Place the SharePoint server in your network, and publish it externally with your ISA server, and please please please purchase an SSL cert for it.