havent worked too much with ISA 2006 directly (quite a bit with ISA 2004 though). From a 2004 perspective, you would need a web/http (and/or https) rule, where the authentication is set to prompt. The problem in ISA 2004, was this setting was useless essentially unless thte ISA servere was a member of the domain (otherwise, it required local user accounts on the ISA server).
Anyways, I'd imagine ISA 2006 can't be too much different in this respect.
-Brandon Wilson
MCSE:Security00/03
MCSA:Messaging00
MCSA:Security03
A+