Green screen and network security

We're having some discussions about what would be the most secure way to
provide users traditional green screen access across a network while
protecting the security of the network.
 
Some ground rules/assumptions are:
 
- Telnet to well know ports (23,25,80) is blocked.
- The applications involved can't be changed. (e.g. to make them web
friendly, must be green screen)
- Only network security is at issue, once they sign on, the iSeries/400
takes over.
- Would prefer no user side software be installed but, if required, it
should be minimal.
 
Anyone want to jump in with their ideas?
 
Kat Kruse
IT Engineer
Qualcomm Inc.
kkruse@xxxxxxxxxxxx