ISA Server can run in one of three modes:

Firewall Only
Caching Only
Both...

However, I suggest they go to some of the ISA sites like isaserver.org and look at the patching scripts on there. These provide a quicker way of applying the port and protocol blocks that are needed for things like Blaster etc.; otherwise adding them one by one is tedious to say the least.

I like the idea of SUS becoming WUS...

Simon