That's doable.

AD authentication can be done at connection to the site but it doesn't have to be. If <add name="Authentication"..../> is commented out in the <httpModules> section of the web.config (the second line that's added when the provider is installed. The first line is a legacy line and not needed) then when users go to the site it's no different than if the AD provider wasn't installed.

However a user can manually login because once the AD provider is installed there are two options displayed when a user clicks on Login. They'll see a button for Standard login and one for Windows Signin. Or if your AD users are only going to be hitting the site from within the internal network you can set what IP address ranges are going to automatically login.

As far as making links only available to AD Users.... if everyone belongs to a general group (we'll say Staff) then you can create a DNN Security Role called Staff and the Staff AD users can be automatically put into the Staff security role. Then setting up pages for just AD users works just like it does any page by giving the Staff role view rights on a page.

Take a look at the documentation. It should answer most of your questions.