[dba-SQLServer] Help... SQL Server Security

I have always used Windows Security for SQL Server because the servers are all mine, and I am the 
only one using them.

Now things change and I need to allow people who are unknown to me access a server on a VM I have 
created just for this task.  Which means I have to learn SQL Server security.

My understanding is that for this specific requirement I need to go to a user / role model 
administered within SQL Server and checked by sql server.

I have two scenarios for now.

Scenario one: A small group of perhaps 4 or 5 users who belong to Lenoir Prison Ministries and who 
will use the database to maintain and utilize a volunteer database.

Scenario two: A small group of perhaps 5-10 employees of a non-profit called Family Support network 
who will enter information about their contacts with families of children with disabilities.

So, two distinct databases, which need to be only accessed by a specific small set of people.  In 
both cases, the load will be small, probably only one or two people in the db at a time, probably 
only for a short period of time.

I have set up a Hamachi VPN and a private network on a Virtual Machine which will be dedicated to 
these two databases.  I have a SQL Server 2008 express instance running on this VM.  My concept is 
that I will assist each user in setting up the Hamachi and getting connected to the VPN, and then 
probably have them download a run-time over the vpn.  Haven't figured all that out yet but I will.

What I specifically need help with is setting up SQL server security such that these people aren't 
Windows users but just SQL Server users.  I am trying to find something that will walk me through 
setting up the groups and users, and then allow me to actually test this.

Any suggested (internet) reading or even an email that walks me through it would be much appreciated.

Thanks,

-- 
John W. Colby
www.ColbyConsulting.com