SMTP from SME-server to your ISP should work without passwords.
Configuring fetchmail is easy, just follow the manual-page (man fetchmail). Version 5.1.2 usually has the man-pages but misses the binary 'man', if you install that, the manual pages work. Otherwise use Google (fetchmail manual).
Spamassassin: See sme.swerts-knudsen.dk
Anti-virus: I use Antivir, others use ClamAv, somewhere on this website there should be a howto.
Upgrading: That's up to you. Version 6 is more safe, but that can be helped when you apply some fixes and are careful with the services that you turn on at the 'internet-side' of your SME-server. Version 6 requires more hardware for the same performance.
Version 6 has ClamAv and Spamassassin built-in.
The upgrading part is somewhat sensitive, you'll see some remarks about upgrading when someone mentions that he still uses version 5.1.2 or 5.6 , so I won't tell that I still use 5.1.2 .