I am assuming that all the computers concerned are XP Pro, a member of an AD Domain and under the control of a single company. This is then the same as our set up at work.
We use group policy to set firewall configuration on members computers, this opens the DCOM port because it is required to allow 'Offer Remote Assistance' to work. Obviously our network is seperated from the internet by a firewall which does NOT allow this type of traffic in!
The DCOM port also allows WMI remote execute. XP also exposes the administritive share (c$ etc) so you can copy files onto the PC. If you can set your installer up so that it can run un-attended then there is no reason why you can't copy it onto a remote machine and then run it. You should also be able to then remotely start the service using WMI.
You should try Group policy first. We use it at work to do several software deployments and it works. We failed to make it deploy a .net written service though, and we also have an alternative in-house system for our .net client applications, that updates the application before running it, so I do accept that it has some drawbacks.
We are currently in the process of rolling out SCCM (SMS), so I can't comment on its abilities but if your organisation can afford it then I expect it would be better than an in-house system.