Use the Security Roles.  They should automatically be populated with identically named user groups in AD.  Then, permit only certain roles to view the website.  Do a "select all" in the AD OU, and add all members to that new group you just created.

It's not a total denial of login, but they'll basically get a blank page if they're not part of the right AD group.

I do not know of any way to do total denial by AD settings...  Due to the design, it appears to me it is an all-or-nothing type of system.  Possibly you can seperate it down to individual forests, but then your AD settings would be problematic.  Anyone that is part of the domain will have an account automatically created for them in DNN.  They may not be able to do anything, but the account will be there.

No, you don't have to have a blank page.  Each module on each page is totally configurable (by security role) as to who can see what, who can do what, etc...  In other words, you can have the same page look completely different simply by what group they are in.