Authentication access policy for intranet site / APM Module

I'm not referring to the back end authentication, but rather how the client browser responds to an authentication prompt. Let's say you could determine that a user, given their IP address, was coming from the internal network. You could send them a 401 response, hope for a Kerberos token, pull that Kerberos token apart, do some lookups, whatever you want, and then send the user down the right path. If the user came from an external network, you'd present a logon form, do some lookups, whatever you want, and then send them down the right path. This is all happening on the 443 VIP by the way. So the the question remains:

1. Can you differentiate internal from external users?
2. And if not, can you use a Basic dialog instead of a form page if Kerberos fails?