Disregard vendor claims. Installing a product is not a magic wand that makes problems disappear.
The specific problem you identified is “spread a lot of viruses.” You mention that this is a problem with managed users as well as unmanaged users.
Identify why there is a problem with the managed users. If SEP 11 is deployed, what has gone wrong? Use SCCM to collect information about the state of your SEP 11 deployment. Do clients have software installed and running, and are pattern files up to date? If not, get that problem fixed.
Selecting and installing a NAC product would be another way to tell you what SCCM can already tell you, but adds a way to enforce restricted network access. Don’t turn on restrictions without knowing how many people will be affected. Use your investment in SCCM first.
What are “unmanaged users?” Truly unmanaged (“we take no responsibility for their conduct”) or poorly managed (“home users with machines we haven’t taken responsibility for”)? How does a NAC product improve your management of unmanaged users?