The paid version has the server in our control, maintained by us.
There is no version of Google Apps that is hosted on customer premise. Your company does not control the servers.
Google only updates the executables and server side stuff
They update whatever they want, its not on your servers. Your admins can select various options regarding what you see and how it feels and when you get new versions of the software, but its all in a Google data center somewhere.
they dont get to see any data or anything.
Google can read all your documents and email in the blink of an eye if its on Google Apps.
The authentication server somehow switches from mail.google.com to $company.com/mail somehow.
Just because your domain is attached to it, doesn't mean you're hosting it. Anyone can do this, even in the free version of Google Apps for Domains. $company.com is DNS CNAME to ghs.google.com. Go ahead, look for yourself.
Our company legal is quite sharp. They really would not like our documents outside our control.
Reality would disagree with those statements on both accounts.
But given the response we get from Google for down times and tech support questions it is likely to be between 50$ to 100$ per seat per year.
Its $50/year, same as everyone else who pays for Google Apps for Enterprises, unless you've negotiated a lower rate.