Answers
1. Do you exclude all directories with the exception of the directory into which the uploads are placed?
It is advantageous to do performance testing without exclusions before deciding that they are necessary. If performance is satisfactory without creating new security holes of our own design, why bother?
2. Do you have real-time scanning enabled or just a scheduled scan?
In nearly all enterprise environments, the answer is "both."
3. How do you have the AV set to respond to threats, automatic or require user-input?
Normally, you want it to respond automatically and immediately but to do something that's potentially reversible (i.e. quarantine, not delete).
4. What about the performance penalty?
It turns out that your choice of antivirus product can make a bigger difference in terms of performance than configuring exclusions.
Anecdotally: in my personal experience, in an enterprise environment, ESET with no exclusions has far less of a performance impact than Symantec with practically everything under the sun excluded -- even on servers with extraordinarily busy drives, e.g. SQL database & call center recording. Be sure to evaluate multiple anti-malware products in your own test environment before you make a decision.
Bottom Line
Unless rules like "no Web surfing from the machine" are enforced by actual firewall rules, you can assume that they will be broken. People make mistakes. Also, it is not wise to believe that you can predict all of the ways that malware is likely to spread.
As the others said, the conventional wisdom is that all Windows computers need anti-malware software, no matter what their role. As administrators, we get to decide which AV product to install and how we need to to configure it.