We're planning to implement an SPS/WSS solution in my company. The
problem is that we have external users that we want to give access
to our WSS server (for teamsite membership). MS suggested that we
use ISA Server to allow external access to the WSS box. The
questions is: how do we handle the credentials for the external
users? Do we allow WSS to create those users in the AD, or do we
create them in the AD and import them to WSS?

Related topics: Once the external users are in the AD, can they be
locked out of other servers/resources? When WSS creates AD users,
what Organizational Unit (OU) does it put them into? Can we control
where WSS puts the new users in the AD?