thanks Jake, that makes sense, but I have a few more clarification q's:
1. setup 2 folders inside server root, folderA-view role, folderB-edit role
2. publish a map service into folderA, no feature access
3. put the same map service into folderB, but enable feature access
All users in edit role will be able to make local copy of feature data, edit it, then synchronize changes with server?
Data that I add to the map, prior to publishing...does it need to be data from an SDE gdb?
If so, I assume the sql-server instance would not necessarily need to be open to the internet for direct-editing as described in my 1st post?
thanks!!