David,
that sounds very similar to what we did recently for a school (even the Win2k replacement

.
I suspect what you need to do are changes for the Samba setup. You don't want to accept guests, only pre-defined userids.
You would have to change 2 Samba parameters in Samba's "smb.conf" file:
guest ok = no and
map to guest = never.
This should be done in a custom-template.
Regards,
Michael Doerner