Looks like there is an online-mode setting that controls regular auth checking.
So, with that turned off, it's just a case of setting up an authenticating proxy server in front of the Minecraft server which does the login checks (against Teh), and it's as simple as that?