TMG Migration - Deny Authentication

Sounds like you could create an iRule to drop or otherwise respond to requests for the Authentication URL and add it to the virtual server using the iApp. Maybe something like this:

when RULE_INIT {
    set static::response "Access DeniedWe are sorry, but you may not authenticate to the SharePoint server."
}

when HTTP_REQUEST {
    if { [string tolower [HTTP::uri]] contains "/authenticate.aspx" } { 
        HTTP::respond 200 content $static::response         
    }
} 

when HTTP_RESPONSE {
    if { [HTTP::header exists "WWW-Authenticate"] } {
        HTTP::respond 200 content $static::response 
    }
}