In terms of #3, why is this an assumption? It would seem to me that you could place those users in their own OU, secure it with GPOs any way you’d like and explicitly deny those users to other resources in AD.

Any way you look at it, you’ll have some extra Admin overhead.

ISAPI (Internet Server Application Programming Interface)
commonly functions as a 'filter' to allow IIS for example
to know what to do with an .asp file type and so on.

While it is possible to use an ISAPI filter for other tasks
the data it would function with still has to be stored
somewhere. Thus, I'd have to concur with Bill's suggestion
to reconsider using the Active Directory Organizational Units.

There is also LDAP (Lightweight Directory Access Protocol) that
you may need to consider and which I believe may also be used
with SharePoint if even not supported natively.

Briefly, what you need to understand are three fundamental
criteria: Authentication, Authorization, and Accounting

Authentication, Authorization, and Accounting
SEE:
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci514544,00.html

Once you understand the criteria involved in an framework
designed to control access to networked resources you will
hopefully understand why you need to learn how to deploy a
directory schema, most likely provided by Microsoft's Active
Directory.

I would suggest you consult with those who provide
network security for your organization.