I am addressing only this part of the question:
And how is PC-to-firewall different from firewall equipment and Windows firewall?
A hardware firewall offloads the work from the general purpose CPU that windows uses to a CPU that is specifically designed for processing large volumes of network traffic fast.
Windows firewall can block individual websites based on IP, but does not do SPI. Also with as much as people encrypt these days SPI can not inspect much of the traffic without SSL terminator.
If you buy software for each PC many of the functions of a hardware solution can be emulated locally, but then each PC has to have faster hardware to accommodate the addition work load. Also nasty root kits maybe able to hide from PC only solutions.
Think about it this way, a hardware solution is like going to a gourmet cake shop and buying a cake. Only the best ingredients were purchased and a master cake chief, or whatever they are called, monitored the whole process. They used all the correct tools, baked and baked it to perfection.
The point is you get to enjoy the cake with no effort on your part.
The software solution is like making the cake yourself. You go to your local store buy all the ingredients took them home. Now you will use whatever tools you have on hand to mix them together and bake. You most likely use inferior ingredients and poor tools and the end result maybe just ok. Then you still have to do the dishes, and throw away the rubbish.
When you are buying a hardware firewall, the vendor has (in an ideal world) hired a security experts to test the firewall and verify it has no known vulnerabilities. Most of them update themselves and require very little hands on once they are properly configured. The vendor assembled all the pieces for you and gave it to you in a convenient package. The will also for a fee have people on staff to help you configure it or configure it for you depending on the contract you sign and the fee you pay.
In a software solution each part of it is like an ingredient that goes into a cake. Each piece has to be individual managed, configured, and updated. Just like our cake one bad ingredient spoils the whole thing. The foundation is the OS which has to be kept current. Then you have your basic firewall which again has to be configured and maintained. Then the SPI package, antivirus, anti-malware, and etc.
Each packages has rules that need updating and the software itself has to be kept up to date. However, instead of being sad you made a bad cake, you company is the news for the next major data breach, and now you have to spend 10's of thousand cleaning up the mess.
I am not saying rolling your own solution is impossible or undesirable I am only saying you need to be prepared to do all the work yourself and initially it will definitely cost more money especially in hours of labor.
