Reverse proxy to IIS/OWA2003: limit basic authentication / double authentication

Hi all,

I configured apache2 as a reverse proxy to exchange2003 owa, to let
users access from outside.

I am currently using client-side certificates authentication on apache,
and basic auth on IIS.
Unfortunately, this config is now inefficient, as users now need to
connect from internet cafes (where client side certs should not /
cannot be installed).

I am now looking for a way to define a list of valid usernames for
basic authentication.
This thing can't be done on IIS, because owa is also used in lan, and,
afaik, there is no way to limit a particular user to a particular ip
class in active directory.

Is there a way to instruct apache to proxy requests only for clients
that use defined usernames in basic auth?

I also thought to use owa FBA (Form-Based Auth) and a "main" basic auth
pass on apache... but I don't know if such a conf. is useful.

Any hints are welcome and appreciated :)
Thanks in advance.

--
Davide DG