...for security reasons I don't want employess to have ANY access to our server what-so-ever.

You can't mean that literally. You must at least let clients connect to httpd. If you don't accept any data from the client, what do you need cgi for?

You don't have the luxury of running arbitrary code on a client machine, but (if the client chooses to accept it) you can provide javascript to do local calculation of that kind. Do not assume that all clients will accept. They may trust you no more than you do them.

How about saying what you want to do in a little more detail? We may be able to help.

Update: I think you ought to price your services under your own control. Many a shopping cart has allowed users to rewrite prices in their favor. A javascript estimator is not a bad idea, but you need to do the actual pricing on your server.