Your client computers will be fine if they're all W2K and WXP.
I'm not familiar with Retina. WSUS will be fine.
You could accomplish such an upgrade in an afternoon with a project of the size you describe. I've done it, using my laptop running a virtual Windows NT BDC that was changed to the PDC and upgraded to W2K3, as the machine performing the domain upgrade.
I'm not sure what you mean by "duplicating most of the matching Group Policies".
The upgrade process, as I perform it, is as follows:
Install Windows NT 4.0 on a "sacrifical" machine, typically a virtual machine. Join it as a "BDC" to the existing domain.
Promote the virtual "BDC" to being the "PDC".
Install Windows Server 2003 onto the virtual PDC, upgrading the domain to Active Directory, migrating to Active Directory-integrated DNS hosted by the virtual machine.
Install the new Windows Server 2003 computer(s) that will be domain controllers. Use the virtual upgraded-W2K3 machine as their DNS server and join them to the domain. Run DCPROMO on them.
Transfer FSMO roles from the virtual W2K3 machine to whatever combination of physical domain controllers is desired. Promote physical domain controllers to global catalog servers.
Get DNS server running on physical domain controllers. Set them to use themselves for DNS. Modify DHCP scopes or IP addresses, as necessary, so that client computers receive DNS from a domain controller.
Demote and remove the virtual W2K3 machine.
In this manner you have no computer that is an "upgrade installation" of Windows (since virtual computer is only used to facilitate the upgrade and then is removed), which is nice and clean.
I've done this procedure many times, much as I describe above. I've even done it during regular business hours while client computers were being used by useres who had no idea this was even happening.
Depending on how you want the new machines to be named (trying to match the names of the old machines is often preferred if they were file servers, since you can match the share structure of the old machines and make that transparent to client computers, too). You could do all of this by adding a new machine, though, and leaving the existing PDC (demoted to a BDC) and BDC intact such that you can migrate away from them at a more leisurely rate.
After the upgrade is complete, your domain member computers (clients and servers) will still operate the same way. You can continue to use your Windows NT "BDC" computers as they are until you're ready to retire them. Exchange 5.5 will continue to operate as it normally would until you are ready to migrate away from it.
It's a very painless process in an environment such as yours. Really! >smile<