If they use Outlook (not express) then you can use SpamBayes.
http://spambayes.sourceforge.net/
It's pretty effective in detecting and canning spam, and doesn't need much configuration - it will "teach" itself from scanning folders of legit messages and spam messages.
If any spam messages do end up in your inbox/legit emails end up in the spam box then it's pretty easy to tell the system that this email is/is not spam - you just need select the message(s) and hit the this is spam/not spam button.