Currently there is no easy way to differentiate a client that is doing a PXE install from the guest clients. However you can provide all the WDS servers in the Remediation Server Group, such that a PXE client will only have the minimum that it needs to complete the deloyment of a image - then the image should have NAP enabled settings such once the image is up and running the client matches the DHCP Compliant policy.
Even if you allow network access to those guests, there is still much value for the NAP enabled clients in that they will quarantine themselves and automatically fixup when non-compliant ensuring that the NAP Clients are always up-to-date and hence safe from threats from the guests.
So really you have the security/flexability trade-off, and I recommend that you get your deployment running smoothly with the easiest NAP integration, and once your running well in this mode you can consider the impact of notching up the security level. Note that the other enforcement methods such NAP IPsec and NAP 802.1x provide secure network separation, and these are further options. But right now you are on the right track by starting with NAP DHCP, and it will provide significant value from having a non NAP enabled network.
This posting is provided "AS IS" with no warranties, and confers no rights.
