We use AD authentication and needed to assign our users to a specific security role. I enabled the LDAP option "Automatically Add LDAP users on first login", and created a User Registered Event Handler to assign that role when they log in for the first time. If you are a programmer or can hire one, you could do something similar and add some more sophisticated logic to assign the correct role based on Active Directory attributes.
Jamie