Yes I do have suggestion. First, you can't run server in mixed security mode. You must use either AD or use the built-in security store. I would use the built-in store after setting up your roles and users as most IT departments are quite restrictive. Remember, serverwill inheriet whatever AD policies are in place. Place the user in the role, and secure the service. The user will then recieve a log-in prompt through whatever api you are using to display the service.
Thanks
David