For link security, if all of your clients support it, use WPA (WPA2 if possible) with AES encryption.
If some clients don't support AES, it's possible to offer TKIP as well.
For client authentication, as usual, it boils down to what resources (human and processing) are available, budget, and administrative pain (coupled to how dynamic your user population tends to be).
If you have a small number of employees / hosts / devices, and they tend to not be a high turnover group, the shared key ("WPA-PSK" or "WPA-Personal") works ok. It is strongly recommended that you use a fairly long and complex key (you only have to enter it once during configuration of each client).
If your group changes, and / or it's a larger group, then consider using an "Enterprise" authentication, like PEAP, LEAP, or EAP-FAST which can be tied to your domain server / Microsoft authentication credentials by was of a RADIUS server (like Microsoft IAS, which you probably already have available).
Security-wise, completely rule out MAC filtering (useless, easily defeated), non-broadcast SSID (useless, no security impact, creates problems with many MS Windows clients), and anything using static WEP.
TACACS+ is very good for authentication, but may be overkill for your scenario. Cisco ACS and TACACS+ offer a lot of options, but if you don't need all the options, then it's just adding complexity.
It gets easier when you remember that the link security and encryption (WPA, WPA2) are separate from the user authentication (802.1x delivered via userlist, RADIUS, TACACS+ by way of EAP methods).
The Planet3 book for CWNA published by Osborne is an excellent reference and training guide and covers the essentials (and more) of how all of this fits together and common / best practice implementations.
Good Luck
Scott
