I recently implemented network segmentation using the Windows firewall on XP and 7 for PCI-DSS purposes. It is most definitely possible (and recommended) to do so.
As long as you aren't restricting outbound traffic from your workstations there generally isn't a problem.
The only exceptions I've found to this tend to be one offs - printers shared via a workstation being a prime example. Most of the other stuff - remote RDP access, inbound WMI or antivirus, etc - can be discovered after the fact as it only impacts IS.
What I've done in the past is to create a group in AD and add certain test computers to it. That group will apply the firewall policy based on the policy delegation settings. That will let you test without muddying up your existing AD structure. It also allows you to update your policies for all in scope systems easily -
psexec \\testsystem gpupdate /target:Computer is great for this.
Go slowly and make sure that you don't cause unnecessary disruption. I also highly suggest using IPSec if possible. The authentication for inbound rules is extremely useful, more so on 7 then XP.