We are looking into implementing an Website/Extranet using MOSS 2007 which will be sat on 2 x IBM 2003 servers clustered together for failover.
These will be sat on our DMZ with a checkpoint FW behind them protecting the internal network.

We will also have our normal internal intranet, the external side is to be used for the General public to browse as a standard website with no requirement to login, just browse as a standard website and POST QUERIES TO US VIA A STANDARD FORM on the website requesting info from us as thousands of websites do, but we will be using MOSS and hosting this ourselves.

Internally
There will be a 2007 moss server which selected internal users will be allowed to update the "external content" on the website, they will update on the internal Moss box and this will then replicate these changes to the 2 external public facing moss boxes.
We will also have our existing WSS box internally which we use at the moment, we are looking at keeping the internal wss option for licencing issues for our internal users, to allow us to some how work round the moss licencing issues ie not have to pay out extra throusands for our 1700 internal users to view moss but view via wss which is connected to the internal moss box which itself is also connected to the 2 external moss boxes, hopefully this will somehow allow us to get round the licence issue as at the moment we have a large WSS intranet.

Security
This is paramount of course.
One problem we have is the external joe public

(not our members of staff off site, nor our existing customers),

the general public must be allowed to view our public facing site on the moss box,
But not be prompted for a user pass just view the site 

BUT ALSO BE ABLE TO FILL IN FORMS ON THE SITE TO POST REQUESTS FOR INFO etc from ourselves which I BELIEVE, not 100% certain on this but I believe is a problem as to allow anonymous access for the public will prevent us from allowing them to post requests for info from us in itself, again I'm not 100% on this.

Our External Clients who have accounts with us.
We propose to use a seperate domain name for them on a seperate IP address to link into the same 2 external moss boxes and allow them to see everything that the general public can see of course,
BUT with one important caveat,
They must be able to login securely to see there own seperate secure sections of the site, one important caveat is that they cannot see our other customers data who will also have there own unique logins.
It would help enourmously if we can keep the customers logins seperate from our own internal AD and SQL accounts.

I appreciate there is a lot here to digest,

But I was hoping someone had done something similar and had some recommendations or links as I apprecitae we will need 3rd party software and or hardware to accomplish the above.

IF YOU HAVE GOT TO THIS SECTION

THANKS VERY MUCH FOR AT LEAST TAKING THE TIME TO READ IT ALL.

Thanks