Can APM be used to restrict access to users that fail Kerberos authentication?

Okay, so your original statement,

"The problem we are having is that even when users aren't receiving a Kerberos ticket they're credentials are still being passed along and they are being logged in to the sharepoint site"

still applies? If so, it's very likely that the client is sending in credentials via Authorization header. So it's just a matter of removing that at the front door.

when HTTP_REQUEST {
    if { [HTTP::header exists Authorization] } {
        HTTP::header remove Authorization
    }
}

This will keep any client-initiated authentication from passing through to the internal applications.