>>1011079 (OP)
I wrestled with this problem while doing IT like a decade ago. (But don't call us /g/)
You should definitely evaluate who can be moved to Unix and who can't. This requires knowing what is or isn't compatible. If someone is just checking e-mails and browsing the web then they're a prime candidate. If they need any kind of specialty software or drivers, then they're out. If you tell us what kind of business it is, I might be able to offer more specific advice.
Bear in mind that a mixed Linux/Windows network can add additional problems getting them to communicate, so if you can't move everyone over then you might need to make additional tweaks at the network level to compensate. One of the benefits of an all-Windows network in enterprise is the ability to micromanage stuff with Active Directory.
The next thing I would do is build your own minimal XP ISO. Since your employer is covering it, you can probably afford NTLite (or just use it for free and don't tell anyone). Remove stuff that nobody uses. Nobody uses a scanner? Remove that. Nobody (unlikely) uses printers? Remove it. Dial-up modem support? Gone. Remove the cruft. This gives you a smaller attack surface.
As >>1011417 mentioned, Faronics DeepFreeze will be a great help. Once you're certain you have a "perfect" image, you can install it and immediately DeepFreeze it. You will need to provide a network share for users to save their files on. Training them not to dump stuff they want to save onto their desktop may be an entire issue on its own though: lusers are resistant to basic things like "navigating to a network folder" and you may need to map it and put it on the desktop for their own convenience.
As others said, airgapping is probably a good move. At least relegate them to their own VLAN so they can talk to your servers and that's it. Use HOSTS to reroute any other request; you don't want to risk them pinging the outside world and redirecting all traffic back to home will actually neuter a fair bit of malware.
Honestly, the real issue is that if people can read e-mails they're going to click stuff they shouldn't. And XP has a ton of IE6 vulnerabilities baked-in. You can also consider anti-virus. Kaspersky is probably Russian Botnet but it's effective at keeping other stuff out, so if you need to cave it's probably your best bet. Although Anti-Virus usually is only good for a few years before getting bloated, so maybe there's something better on the market now.
There may be some more elegant solutions, though
Everything from here on out is spitballing based on newer options you have that I didn't when I had these problems. They may be doable but you will need to do additional research.
First and foremost, switching to Linux is the best way forward. Your simplest solution is to pick a stable LTS distribution (Preferably not a Debian-based one, but the best alternative is Fedora or CentOS, and IBM owns those now) and to put it on all the old machines in lieu of outdated versions of Windows. Bar none, this is the most straightforward option you will have.
But, you will need to test out everything before rolling it out. Every driver and piece of software will need to be manually verified by you and users will either need a DE that is close to Windows or just one simple enough to "just work". If you can get all the special enterprise software working in WinE then you're probably 90% good to go.
Other users have mentioned issues with stuff like scanners or other peripheral devices. This is certainly the case. There's no easy workaround for specific hardware keys (I've encountered software that uses hardware dongles to verify purchases) but if it's just scanners and such then you can probably configure a server to handle it at designated Scan Stations. Or just hope the company already has a Xerox machine that supports USB drives.
Another option that may be viable, but is a longshot, is ReactOS. It's still in Alpha and not super stable, but support for older software is generally better. I'm not sure if it's any more secure than Windows, because it's supposed to be identical, but it probably isn't using IE6 to render internal UI elements, and that's like 99% of exploits right there, so it may help. I think this solution is more trouble than it's worth; you may verify everything and then find one thing that bombs the entire system. It's not stable nor necessarily more secure, but it is free software and it may be an improvement.
Ultimately, it's up to you to use your head, OP. There's too many details you left-out about your company, its current infrastructure, what they do, etc. The best solution for your employer depends heavily on the mix of other PCs and how much authority you have to exercise here.