I did have NTLM SSO enabled on this test one (IIS internally + externally) at one point, with external users authenticating via Forefront TMG. That took a lot of faffing by our TMG admin. But we've switched our plan to use Shibboleth SSO now, as for us that means users then can SSO straight into eResources.
It looks like we'll be using Shibboleth to power logging in to Office 365 when that is implemented over the summer too.