Hi Fred2k,
AV and IPS are the two absolute "must haves" in my opinion. Together they are responsible for about 90% of what SEP typically stops. However, both rely upon definitions. For brand new threats that definitions are not yet in place against, SONAR is a great tool to detect malicious processes. It's an extra line of defenses for anything that gets past IPS and AV, and it's definitely recommended. (I recommend Download Insight and Firewall, too.)
SONAR is not usually something that has much of an impact on performance... you may wish to perform a few studies/tests or get in touch with Tech Support.
All the best- please keep this thread up-to-date with your progress!
Mick