ZoneAlarm (and the like) are usually installed on the SERVER, rather than the CLIENTS. When ran this way, it will offer protection for inbound and outbound attacks on the SERVER PC, but will offer no outbound protection on the CLIENT PC's. Outbound protection is mostly for "trojan/virus" activities. ZoneAlarm has the ability to be set-up as a "SERVER" or "CLIENT" on the computer it's installed on (it's a check box).
Just make sure you manually add all the IP's of your LAN PC's on your SERVER ZoneAlarm install, and if you install Z/A on the CLIENTS, include the IP address of the SERVER on all your cliens (as trusted).
While I no longer "like" Z/A, it might serve you well if the people using the CLIENTS receive email attachments. Z/A will castrate any trojan attachments they may receive.
Hope this helps 🙂