You would probably get more information from the guys at the Windows 2003
Server than here. I will give you what I know:

1. First level of security will be the Access Points security. You should
activate WEP Encryption and maybe also MAC Address Filters (if you know all
the devices that will connect and can collect their MAC addresses). These
will already filter people who can and cannot connect.

2. The domain authentication comes next. I don't know exactly how this works
in terms of setup in the server, but just like the PC logs into the domain,
the PPC should receive a login screen at the moment it first tries to use a
domain resource. I believe the setup of the server should not be different
than for a regular PC, but maybe you should ask about that in the proper
newsgroup.

3. For the Exchange 2003 Server, Activesync with the server will take care
of the authentication.