Generally speaking Windows 98 is having a security level much lower than the level that requires for most of the Internet-base computing task so I still recommend you to upgrade to Vista as soon as you can. However, if your environment is having Windows domain, you can use policy to govern some of the software installation capability. Or you can just use registry to restrict certain task though not recommended.
For Internet access, since you have antivirus software installed, it needs to go to Internet for signature update thus completely blocking Internet access is not a good way. Instead, try the recommendation from Daniel Lai above, deploy ISA solution may help, since you can optionally block/allow Internet traffic with ISA easily, and it's simplicity make it works well in standalone mode as a firewall box, even in a light environment like yours, and it's price-performance ratio is far better than any other firewall products in the market.
You can contact Microsoft Hong Kong for more detail on ISA appliance deployment in SME environment.
