Presumably, these employees probably need email, web access, and file sharing.

There you go. Those are your threat vectors now.