1. OWA needs to communicate directly to the exch server and also needs to contact the domain controller.
While it's not a bad idea to have it in the dmz, you have to allow it to contact the other servers.
A way around this, beleive it or not, is to put a second nic in there. so you have 2 nics, eth0 and eth1. eth0 would be your public address with a gwy and dns. eth1 would just be your pvt address, no gtwy or dns. !!!In order for this to work they must be on 2 different subnets.
Then in your lmhosts file, specify the address to your exch and dc server.
2. SSL- if this is just for local users, you do not need to go out and buy a cert. However, you do need to encrypt the traffic. Do this by generating your own key. After it is installed, and your user connect, they will get a warning box about the cert not being verifable. it does'nt matter since you created. If your users press yes and trust the cert, the session will be protected via ssl.
And that is all that matters really. Also make sure you enfore 128bit.
3. lastly, when your users connect, they are going to be prompted for a u/p. they will need to put the domain identifier in. ie domain\user