First off, install that firewall, pronto. A perfectly decent hardware firewall costs a few tens of bucks. In fact, are you quite sure you don't already have one? I would expect that your network hub has one -- that's the box with the ports that your LAN machines plug into and the port where the WAN (Internet) cable goes.
If so, you should be able to configure the box to restrict WAN access to any individual computers. You'll have to assign them hard-coded IP numbers (instead of letting DHCP do the assigning) and then create the settings there.
BTW, you're not allowed to use AVG Free in a corporate environment. If somebody working for AVG happened across your message (or just liked to snitch) they could bust you to your local anti-piracy group, which would not be pretty. So upgrade those licenses first. (Nothing wrong with AVG, btw -- it's a perfectly workable anti-virus kit.)
Finally, do make sure your WLAN is properly protected too, otherwise someone can waltz right into your intranet.