However, a few weeks ago I was reading a paper on how a bunch of smart hackers came to exploit a PDF file and make it launch executable code.
PDF files... pah... that's for beginners.
I've seen tales of exploits hidden in innocent looking jpeg images.
Given that my internet work will be done on a W7 box, is this an acceptable option for keeping the XP machine alive on the local network but shut off from the big bad online world?
Configure the IP manually (both v4 and v6) and do not set a default gateway.
Machines on the local network will still be able to see the XP machine, but the XP machine will not be able to find its way out on to the internet.
BUT ... the ideal solution is still to rid yourself entirely for XP though, because if you get an exploit on to the XP machine, it will still be capable of infecting your local network, and thus get onto the internet indirectly.
I still have difficulty believing you have a genuine reason for running XP though .... print & file server is no excuse.... ;-)