Many ways to go here.  Probably the most secure is to keep your internal web
service internal.  Add a standalone domain to the DMZ for external users and
allow access to the sql connection from inside the web service using CLR
role based security (could also verify users against db but I prefer
leveraging windows if possible).  That provides clear seperation, however
that means dual admin of users and passwords and security rights.  And
depending on what they need access to, you may have to have trust links
anyway.  So the another option would be to just add auth to AD (assuming AD
here) from your web services.  This allows you to leverage existing accounts
and rights and internal management tools.  For external only users, just
create them an account and make them a member of only the "External Users"
group (or what ever.)  Make sure External Users group only has access to
just the specific things they need (i.e. files, etc) and nothing else.
Remove them from Domain Users group as well so the only group they are a
member of is External Users.  You can also add CLR role based security on
all your methods the web service calls for things that require security so
you have both CLR and OS/NTFS security.  CLR required roles may then allow
either Domain Users and External Users to allow both the special external
users and existing domain members.
--
William Stacey [MVP]

mixed