Agree with EK and AliGibbs. I would use Virtual Box and use the snapshot feature. Configure an XP virtual machine, update it, install firefox or chromium, take a snapshot and then virus it up. When it gets infected, roll back to the snapshot, which is really simple, you could teach your users to do it, and then surf away again.
I've never used HVAP, but I have used ClamAV and it's slow as molasses. I'd think you would have to have a pretty beefy box to run it in a proxy config and keep the users from clawing their eyes out with the slowness. I have used an IronPort and it provides AV as well as content filtering and the like, and it's nice and fast...and expensive. So it's probably not what you're looking for, but it will do what you want. It can be used in a proxy config, in-line, or redirected from firewall.
I don't know if this is a violation of the EULA, as I'm no expert in that, but When you roll back to the snapshot the activation window rolls back as well. At least with XP on virtual box. Up to you whether this is moral/ethical/legal, as I don't know. You could also install linux as the guest OS as this is free. Unless they need XP for the virus surfing activity. There are plenty of pre-installed/config'ed downloadable images for a variety of distro's. I like Linux Mint for the most XP-user-friendly experience.