Hi,
I think you're going to be out of luck for this:
1 - Yes, Ironport will connect to LDAP for authentication.
2 - An authentication page as such isn't included, you might be able to edit the End-User Acknowledgement page to add a login to this, would be a bit of work though.
3 - To the best of my knowledge there is no logout function, you could lower the End-User Acknowledgement timeout so they have to accept, login if you managed to successfully alter the page, to an acceptable session time.
Thanks
Chris