Another vote for Java/JEE here but that's again because it's what I'm used to and it's not knocking the MS technologies. However, as JIMA points out quite rightly, you should consider many factors before deciding on the technology. First and foremost you should consider what technology stack that the company will be using. Are they a MS platform, or Unix/Linux? Who will be supporting this application once it's live? Are license costs an issue? What skillsets are available?
In my experience the three tier approach is more performant (seperate database server) but in your case the volume of users is quite small (I'm used to writing massive applications for one of the UK's big banks). However, do consider the impact of licensing on the design. For example, Oracle licenses are per CPU I think. So if you put it on the same box as your application layer then you'll need more CPu's on that box and therefore a larger number of Oracle licenses. That's just an example of course - you probably won't be using Oracle.
Your should also ensure that a backup strategy and also a disaster recovery strategy is considered if it is a business critical application? You could consider clustering here as it provides an active/active recovery position.
Again as JIMA pointed out, you should consider costs for the life cycle of the application and not just the development (in other words it can cost more to support the application for several years once live than it does to develop it).
In my experience the three tier approach is more performant (seperate database server) but in your case the volume of users is quite small (I'm used to writing massive applications for one of the UK's big banks). However, do consider the impact of licensing on the design. For example, Oracle licenses are per CPU I think. So if you put it on the same box as your application layer then you'll need more CPu's on that box and therefore a larger number of Oracle licenses. That's just an example of course - you probably won't be using Oracle.
Your should also ensure that a backup strategy and also a disaster recovery strategy is considered if it is a business critical application? You could consider clustering here as it provides an active/active recovery position.
Again as JIMA pointed out, you should consider costs for the life cycle of the application and not just the development (in other words it can cost more to support the application for several years once live than it does to develop it).