Ofcourse its possible. Only you'd have to tap into the winlogon apis
(which you get for free if you dont use a custom username token
manager). So in your situation heres some steps you might potentially
end up doing

1. Have a subclassed UsernameTokenManager
2. Distinguish users based on username token on whether they need to go
through windows authentication or external authentication
3. Pass it through your username token code for external users (Hint on
how to do this can be got be using reflector on the WSE dll)
4. Pass it through your Windows authentication routine for internal users.
5. Return the password in either of the paths at the end of the
overriden Authenticate method in the manager