A whole lot of 5 users, I realize that in bigger companies it's probably less hassle to just install AV software and "hardblock" undesired behavior.
I imagine that depending on the country you are operating in this might even be a requirement to prevent legal hassle, getting sued for "neglect" if not running AV software and something actually goes wrong but IANAL.
But let's also keep in mind that AV solutions can have the exact opposite effect of what they're supposed to do, from data leakage [0] [1] to straight up remote code executions [2]. Which isn't that surprising, considering that more complexity is usually a bad thing to add to any system, especially if it's as deep-rooted as most AV suits tend to be.
How many users do you administer again?