[Zope] Q's about Zope security model tweaking

I'd like to make a 'fallback' authorization scheme for Zope. That is: If user does not exist in usual UserFolder, then authenticate against custom module (NIS, in this case) and give them Anonymous privileges. I want to do authentication for a whole subset of the site (indeed, its entire public face really), but don't want a huge userfolder build from NIS. nisUserFolder doesn't seem like the right solution since I only want to use nis if they don't auth in the customary fashion. Can anyone give me some general pointers on this admittedly broad topic? --JB