A hardware firewall will only dish out IPs if it has DHCP server capabilities. The reason you cannot see the boxes on his side of the router is that they are probably on a seperate subnet or are not passing SMB traffic properly. Before throwing firewalls and routers on the network, you should really have a good understanding of how they work and how they will effect your overall domain structure. Sticking a plug-and-play router onto a corporate LAN and expecting it to work will only cause frustration and headaches. I think what you need to do is strip the router of all its extra capabilities. Turn off NAT, turn off DHCP, then create a seperate subnet for those users on the other side of the router and update all your LAN's routing tables so that those routers know how to get traffic to that side of the domain. Then, only after all traffic is running and your routing works right (you can ping all parts of the lan), build an access control list on the router as to what type of traffic you want to block, incoming as well as outgoing.
If your talking of a shelf-bought lynksys router, you should probably get rid of it, then build a router from linux and block ports with iptables, or get router that allows you to build a good access control list).