This procedure is not pretty, but its the best I can come up with given the concatenated IDs. It should also work faster than the FIND_IN_SET solution, because it can use the index on EMPLOYEE_ID.
CREATE PROCEDURE `test`(IN `dep_id` INT, IN `emp_ids` TEXT)
LANGUAGE SQL
NOT DETERMINISTIC
MODIFIES SQL DATA
SQL SECURITY DEFINER
COMMENT ''
BEGIN
START TRANSACTION;
IF(emp_ids REGEXP '^[0-9,]+$') THEN #this will NOT guarantee a valid query but will prevent injections
UPDATE TBL_DEPARTMENT_EMPLOYEES SET IS_ACTIVE=0 WHERE DEPARTMENT_ID=dep_id;
SET @q = CONCAT('
INSERT INTO TBL_DEPARTMENT_EMPLOYEES (DEPARTMENT_ID, EMPLOYEE_ID, IS_ACTIVE)
SELECT ?, EMPLOYEE_ID, 1
FROM TBL_EMPLOYEES
WHERE EMPLOYEE_ID IN (',emp_ids,')
ON DUPLICATE KEY UPDATE IS_ACTIVE=1;
');
PREPARE stmt1 FROM @q;
SET @dep_id = dep_id;
EXECUTE stmt1 USING @dep_id;
DEALLOCATE PREPARE stmt1;
END IF;
COMMIT;
END ;