Windows 98 and security are pretty much mutually exclusive. I would suggest going to 2000 or XP so you can make use of NT authentication and NTFS. The problem with a workgroup using NT security without a domain is you have to set password on every machine. If you have enough machines and enough budget, you'd certainly benefit from a domain.
If you had a domain, you could set up different Organizational Units to break your workgroups into, and deny access to one from the others. Marc Creviere