Yes, the SA500 supports firewall, email protection (protecting spam, virus with its ProtectLink Gateway offering), and endpoint protection with Endpoint Protection.
This may be late but for future referece... the proposal looks fine for what has described. The only one thing is the requirements say the end-customer has 40 users in HQ so you may need 2 of the 25-user Endpoint Protection license if the effective users needing the protection is more than 25.
Another info may be interesting is we also offer bundle package.
See the link below and then go to the "Product Bundles" table. You may consider to use bundle package, i.e. SA520 Gateway 25 Bundle
Article ID:3091 Reboot and Factory Default Reset on ISA500 Series
Integrated Security Appliances Objective Reboot or restart of the
network device is made when certain changes in the settings need reboot
or if the device is frozen. The configuration setti...
Article ID:3403 WAN Quality of Service (QoS) Policy Profiles Settings on
ISA500 Series Integrated Security Appliances Objective Wide Area Network
(WAN) Quality of Service (QoS) policy profiles manage traffic through
classed-based profiles. These profiles ...
Article ID:2922 Cisco QuickVPN Installation Tips for Windows Operating
Systems For a video showing installation tips on Quick VPN, visit
http://youtu.be/hHu2z6A78N8 Objective Cisco QuickVPN is a free software
designed for remote access to a network. It is...