The solution we ending up going with was a bit of a hack.
Internal intranet access
An AJAX call to /sitecore/admin/ldaplogin.aspx is made in the background to log the user into Sitecore automatically with Windows authentication. Yes, apparently you can do Windows auth over AJAX with both Internet Explorer and Chrome. If there are no errors in the AJAX response the page is automatically refreshed, and their username is displayed in the upper-right-hand corner. Because all our users are tied into Active Directory they do not get the Windows auth login pop up.
External internet access
URL Rewrite checks the X-Forwarded-For header set by our load balancer to see if the traffic is coming from within our network or outside of it. (If you don't use a load balancer you can just reference their IP address.) I got a list of regular expressions that represent Class A, B, and C networks and created the rule in URL Rewrite to block all public access to /sitecore/admin/ldaplogin.aspx. This means when accessing the site externally the user will not get the ugly Windows authentication pop up because URL Rewrite rules are processed before the Windows auth process takes place. Instead, the user must login to a custom-made Sitecore login form.