I think you're describing two different types of authentication. If you would like IIS to authenticate directly (using NT ACL's - e.g., by right clicking on a file and setting files sharing permissions), then you are going to use users/groups in the NT SAM. This is a much better/easier way in IIS to manage it (if you can get away with managing accounts using NT's User Manager).
If you need a more dynamic list of users (like a site where people frequently register themselves for access), then you'll need a database of some sort to manage users/passwords. There are lots of examples on this site (mostly using MySQL).
So I guess the question becomes what kind of user account mgmt do you need?
Dave
===========================================
http://badblue.com
Small footprint P2P web server for Windows,
File-sharing, PHP, wireless apps & more