1. Broker/Connection server tags could be one way to limit which pool is access through which broker/connection server
2. Not sure about this. It sounds like you want no human interaction (is this correct?)
3. Kiosk mode doesn't make a distinction as to whether it's the thick client, thin or zero. It associates a client by it's MAC address to an AD account that's entitled to a group.