First of all, based on my experiences with them, Sonicwall SUCKS. I mean, I generally hate all AV products, with a couple exceptions that are "alright," but don't get a Sonicwall. They're just... awful. I've had nothing but problems with every Sonciwall device I've administered. YMMV.
But yes, a webfilter can help to some degree. How much... well, that depends, and brings me to your comment below.
They have admin access to their machines, and that's not going to change.
Then you may be screwed, no matter what you do. Even experienced sysadmins and IT folk don't regularly run as admins. (Ones who know what the hell they're doing don't, anyway.) At the very least, get them to log on with limited credentials and use RunAs/Run as Administrator when they need to do something with admin credentials.
There's simply no defending against the countless unpatched and zero-day vulnerabilities floating out on the web if you run everything as an admin. They'll get you every time because Java/Flash/your browser/whatever is running with administrative access and will install any nasty bit of code it's asked to. That's why MSSE is letting you down. Not because it's a bad product, but because nothing protects against 100% of the crap out there, and your users are running in such a way as to allow 100% of the undiscovered crap out there to infect them.