make security in two part of institute

Hi
I have one education institute that has 2 parts : student part and
staff part with an ADSL internet connection.
i install Xp2003 Server/AD/DNS for staff lan , this lan contains some
important software and Mcafee local server AV.

i want to my students in its lan can access to internet and its client
can update from local Mcafee Server.
My question is : how i can increase security that students can not
access to software on staff lan or access other resource? and this is
a good way that i define this two lan in one domain?
thanks.