Happy to help with the Robocopy script if you go that route. Yes, Powershell is also an option for scripting if you wanted to.
Bvckup was only a suggestion as I use it all the time and know it's reliable, but it's not free.
I agree a full server is probably overkill, as it will obviously need extra maintenance to keep running. I'm a big fan of Ubuntu/Debian (run Ubuntu on my work laptop, and a variety of Debian servers in my home lab) so can recommend them if you went that route. Would definitely avoid Server 2008R2 as it's based on Windows 7 and is end of life in January. If you went with Windows Server, I could only recommend going with 2012R2 at a push or 2016.
WSUS Offline is a pretty neat tool, but note that it only downloads the core Windows Updates - i.e any updates specific to your hardware and some feature updates aren't downloaded. Also, since Windows 7 is end of life in Jan as well, there won't be any more updates after then.
Overall, in terms of what I think you should do, in priority order:
1 - Ensure all machines are fully up to date and patched
2 - Make sure that users are using standard user accounts and create a separate admin account they don't know the password to.
3 - Set User Account Control to maximum in Windows 7
4 - Configure Group Policies (if you're running Windows 7 Pro) to lock down the computers as much as possible.
5 - Set up the watch folder system with Robocopy
I note you said the printing PCs are running Windows 2K and XP - are those 100% disconnected from the internet? In Windows XP Pro, you can use Software Restriction Policies (SRP) to prevent users from running programs and executables they're not allowed to:
Hardening Windows XP with Software Restriction Policies. You could also set up SRP on Windows 7 Pro if you had it and wanted to. Also, make sure that the user account in XP is also a standard user, not an administrator.
Also, to help secure the XP machine, I would install and configure Microsoft EMET (Enhanced Mitigation Experience Toolkit). Whilst EMET is discontinued by Microsoft and no longer receives support as of last year, it still works fine on XP and allows you to enable security features that are now core in modern versions of Windows but didn't exist back when XP was released. You can download EMET here:
Download Enhanced Mitigation Experience Toolkit (EMET) 5.5 from Official Microsoft Download Center and find more info here:
Quickly Secure Your Computer With Microsoft’s Enhanced Mitigation Experience Toolkit (EMET).
Appreciate I'm throwing lots of information at you, so let me know if you want any more detail about anything in particular.