Interesting, a few thoughts off the top of my head...
You say that the Intranet and Internet networks do not touch in any way. How so? Let me explain... All the PC's (running XP and 2000) utilise roaming profiles. This means, to me any way, that they must all be on the Local Area Network. Is that right?
Assuming that all the PC's and servers are on the same Local Area Network, I would do the following:
1) Configure a server (or even better server farm) for the Intranet. Inside the Local Area Network.
2) Have a seperate proxy server for Internet access (Internet gateway). Connected to a T1 pipe to the Internet through a firewall. Have some web filtering / anti-virus software installed here too.
3) Have a seperate Intrusion Detection System server monitoring the Internet traffic. May be with a seperate machine to dump and process the logs.
4) Use a seperate server for the roaming profile and user authentication.
5) Ensure the Local Area Network is switch based rather than hub.
6) Install anti-virus software on all the PC's and have them automatically updated / managed from a central point, perhaps the Internet gateway.
7) Upgrade the 2000 PC's to XP Pro. That way you have commonality.
I'm sure other, more knowledgable AO'ers will be able to pick holes in this or enhance it. Please feel free to critique.