Hi Eugene,
If everyone who will be accessing the site will have a client certificate, you may be able to use IIS to require certificates granted from a particular authority and skip DNN entirely. For narrow cases, this is an easy solution.
If you will require some users to have certificates, and others will be unauthenticated (or use a different credential), or if you will have needs that vary across portals, you will probably need an authentication provider and interface. This is likely to look a lot more like the OpenID or Active Directory authentication options than the multifactor provider (though the method by which I validate client certificates will certainly be applicable for you). You might look there for additional inspiration.
Answering your questions:
1) It is possible to require that a user be a member of one or more security roles across an entire site.
2) Do not extend the Users table; this would be considered a "modification of the core" and would affect your future upgrade path. DotNetNuke already has a built-in mechanism for external authentication (e.g. OpenID) that you will be able to leverage. You are of course always free to use your own tables.
Note that I would consider this to be an advanced task for a developer; though much of the implementation is straightforward, anything that touches security this heavily is of increased difficulty.
Hope this helps!
Brandon