Consider using an Application Role rather than user level security.

Look in Books Online for "Establishing Application Security and Application
Roles".

That's hard to say as this line doesn't make sense:
"Second, the app must be available to someone that does not
have  a windows login, eg a field worker that needs to
access the app occasionially  using a machine running under
a different users login"

So what login is the "different users login" - but the user
doesn't have a login?
It really depends on what login is being used, if the field
work is accessing a machine in a domain, if it's multiple
domains, depends on trusts that may or may not be setup,
etc.
In terms of the other issue, Machines and logins are two
different things. If I have my windows login setup for
access to a SQL Server box in my domain, it doesn't matter
what machine I use. If I login into the network, that's the
credentials that are used no matter what machine I may be
logged into.
If users are logging into the domain with all different
logins, accessing network resources with various logins then
you have a security mess at the network level which will
lead to security messes in SQL Server as well when
implementing Windows authentication.

-Sue