I'm not sure what the exact network topology is or how users will access the network. If you are looking for a form of Authentication before users logged into NT you could do this with cisco Catalyst switches starting with the 2950's using 802.1x.
In order for a user to be able to pass traffic on the switch port the switch will query an AAA RADIUS or TACACS server for authentication/authorization parameters. If that passes then the user can pass traffic on the switch port, and log into the Domain.
You need NICs that will support 802.1x in order to do this.
Daniel