Firewall - Very limited Access - suggestions

[Kevin F. Berrien]

I'm intersted in building a bastion firewall for the following 
sistuation.  Have a closed network (police dept).  There are no crosses 
to the internet.  However, we'd like VERY LIMITED access by the Windows 
DC server for the following: Windows update (via SUS), Symantec AV 
updates, VNC/or remote desktop connection to 1 or 2 workstations on our WAN.

Thus, I want to limit all traffic except various protocols/ports between 
specific IP's/URL's.

Certianly FC and iptables can do this, does anyone recommend a 
configuration utility, start off  scripts, etc?  Should I be looking 
more into LRP (now defunct), etc?  My iptables knowledge is not great 
(did it years ago), so some configuration utility would be great, and my 
co-workers isn't experienced in this area at all.