NTLM will still work, unless they are proxied. If you allow ONLY SSL,
then I would consider using Basic Auth and NTLM. IIS will use NTLM if
possible, and then default to Basic in this configuration.
Of course, there could be integrated authentication issues with Basic,
but it should work.