If a non domain user hits any of your network shares they should still be prompted for a domain account if permission's are set correctly, also if you just want to say stop kids from hitting your wiki why not just change the port to something other than port 80?