login script or profile

I am in the midst of upgrading an Windows NT4.0 server, multi-user system with W98 workstation clients to a Windows 2003 Enterprise Servers (in a Clustered Server configuration) with Windows XP Pro clients. One of the issues I am attempting to resolve is having a uniform login for specific client user groups. When a user logs into the Domain via a client workstation that user would have only access to those resources intended for that specific group. I intend to accomplish this with the implementation of roaming/mandatory user profiles. In this scenario, some of the clients are users of a Point of Sales (POS) system. They require different access to different resources then those of the accounting/bookkeeping department. Specifically, when a POS user logs in I wnat them to have specific network drive mappings and automatically have only their specific applications automatically load on their workstation and not giving them access to any other applications or resources via the START menu. Meaning, I want to have absolute restrictions for that user group.
It is my belief that this can be accomplished with mandatory user profiles. So, I am also interested in this discussion relative to login scripts and user profiles.