Hi Colin,
Having a background in IT dept too, as well as programming, opening a new port on a PC always makes it less secure, that's just a plain fact. Installing and/or activating Firewalls to secure it, still makes it vulnerable if the user takes down the firewall or changes it's settings.
Ryans points are quite good and should help you make your options clear. I agree with Ryan, that if you will only run your app local on each PC on a local webserver, Thick client would be my choice.
Palli