In general, when a user logs in either manually or automatically the code calls the Authentication Controller file. From there it authenticates against the AD either by passing the username/password (in the case of a manual logon) or just the username. In this process it pulls back the user object from the AD (contains all the information about the user that's available from the AD) and uses that information to create a DotNetNuke user object. It then logs the user into DotNetNuke as a normal DotNetNuke user.

The reason I say that you need to use a user that has read access (which is pretty much any domain user) is more of a "save myself from a bunch of posts" deal. It really depends on how the network admins setup the AD but generally AD setups will not return any information if the request isn't coming from an anonymous or unauthenticated source.