Office is a security disaster

I'm about to start managing 'computers' for a small office. Very small- one desktop and at most 2 or 3 other laptops, maybe 8 cellphones.

Boss doesn't use a computer, the secretary (who will never get fired) sits at the desktop all day shopping on Amazon and scrolling through Facebook. Constantly complains about how slow the brand new iMac is.

Running top and netcat was enough to tell me that something was seriously wrong. They're lucky that nothing important was on that computer, because it was a mess. Apparently they've had a lot of issues with phishing emails in the past, I found out later.

So. Looks like there's a task on my hands here. Network security isn't my strong suit, but I know a thing or two, I guess. I run some home servers, PFSense and a Pi-Hole. Data is where I'm more comfortable, though.

Anyway, some very sensitive data is getting cleaned up, migrated and normalized- but there's no way it can go near that network / computer in its current state, without taking some serious measures.

My thinking was to get a firewall appliance, like a SG-3100, then create a VLAN for all the mobile devices. But unfortunately there's no way I can teach this woman not to open every single email attachment, and who knows what else. Any suggestions?

TL;DR: Hired to migrate extremely sensitive data at a small company where nobody knows anything about computers. The boss's secretary sits at the desktop all day and opens tons of phishing emails. Am considering a SG-3100, w/ PFSense, but know I need more than that. Please help.