[Zope] Authentication questions

Hi listers, I'm currently discussing requirements for yet another Zope/Plone portal for the company that I'm working for; and the issues with this particular site include mixing accounts from both internal employees and external consultants. Not all employees will have access to this site. The internal staff are currently authenticated via Windows (and Active Directory accounts) which is a critical requirement. The external folks will only be accessing this one site, so their accounts are very site-specific. What is the most logical way to have both specific AD accounts (not the whole directory) and Zope user accounts authenticate for one site? -- Mitch