1. No problem with those protocols, Cisco routers are designed to route IP and Appletalk, along with IPX and others.
2. That depends on 3 things. The type of router, the type of access list and the amount of traffic you are passing through the router interfaces. Simple access lists base on IP addresses take a minimal load. The further you filter in the IP stack, the more the router has to work. If you have 500 hundred workstations hammering a 2500 series router loaded with extensive accesslists, you are asking for some latency and dropped packets. But anything is possible with the right touch. It would be nice if you could get some statistics about the applications you will use and the proposed workload they will put on the network.
3. You are definately have to read up on security. Security starts from the center out, in a layered fashion. It starts with user education, user w/s security, the server administration, then your network infrastructure. No access list on a router will protect your server, if the server doesn't have the appropriate patches on it. You must take a holistic approach to security. A quick blanket approach when you start will work. This will be where you apply common security techniques to all attached devices, then you can get fancy with securing server services, in-depth access lists on the routers and switches, and end-user education on passwords, security etc.
I am sure other people will chime in with their 2 cents worth. If you can get a handle on what your users load on the network will be, and the shape of the traffic distribution, that would be a big help for the design. Obviously someone in your company is driving the application. Talk to them, find out what exactly the application is, and what are the demands that application will make on the network.
Above all, have some fun. All of us could argue all day about the particular designs of a network, and how 'I' could have made it better, but in the end, as long as the application works, the network doesn't drop too many packets, you aren't losing anyone's email, the database hums, and back-ups are being done on time, be HAPPY!
