I'm assuming from your post that you aren't running AV? That's how I read it anyway, as you don't include an AV solution (which is what this post is all about)
Security Lesson #1: Usability, Secure, Cheap - pick any two.
Anyone can put up a solution that provides two of these, however I think the solution you have put together provides only one.... Cheap!
Working from a VM? Not usable - at least not for typical office workers.
No AV protection? Insecure
Allow me to elaborate on insecure...
Fair enough, you 'reset' your virtual machines when shit happens, but what about when a virus sends out spam from one of your IPs and gets your blacklisted? What about when a virus/trojan/whatever leaks confidential business information? and how do you know if things get nasty if you aren't running AV?
The viruses you need to worry about, are the ones you probably wouldn't detect without AV protection, as these are the ones most likely to do your business harm.