How to apply a filter for user that fail to authenticate?

OK - this might be an odd question...

I am using the Web Proxy and have a Profile setup that uses active directory SSO authentication, which works fine for my handful of family members that utilize any of the available computers in the household with their roaming profiles etc.

My main reason to use the Web Proxy with the active directory SSO is to have the ability to assign specific filters and date/time restrictions to the kids. This works very well - too well if you ask the teenager:)

What I am looking for now is a way to still grant access to user sessions that fail to authenticate using the active directory SSO. So I want the Web Proxy to apply certain filters and restrictions IF it can authenticate the user, but I want it to also apply another set of filters and restrictions if it can NOT authenticate the user.

At current it looks to me that unless you have been authenticated you cannot get access. That is a little bit harsh for some of our family guests...

Any suggestions that do not involve fixed IP's or IP reservations etc.?

Martijn.