[Samba] 'multi-layered' authentication

[webster at lexmark.com]

I need to allow [read] access to a Samba server using both IP filtering & 
UserIDs .

For a given list of IP subnets, any user should have access.
Outside these 'trusted' subnets, I need to do User authentication.

I can handle the User authentication OK in several ways.
However, I don't see any way to do the 'short circuit' allow for some IPs, 
then use User authentication after that.
If I do a 'deny', in the InetD or in Samba, then the 'untrusted' subnets 
are denied, & not allowed to try logging-in .

Any ideas?

I originally thought that PAM would give me this functionality, but now I 
don't see it.
Is PAM at all popular for Samba 'authentication' ?

Thanks.