Derek Law correct me if I am wrong, but from everything I have read, and staff I have talked to, once Portal is federated, (taking over security) items are either shared as "public" or it requires a named-user.
With secure services in AGS, a proxy works well for controlling access to secure services (for web sites hosted locally). But this is not an option for Portal I don't think (from a legal licensing standpoint). I know you can not talk licensing, but this is something users need to talk to their customer rep about, IMHO.
(I'm recommending not federating Portal in our shop, at this time, for that reason)