Hmmm. I think I might be inclined to go with a slightly different approach than integrating authentication to access your sensitive documents store with your Active Directory setup. Because, in my view, then the security of those documents would then become almost solely dependent on the security of your AD setup. And that might not necessarily be a good thing, security-wise.
It's not that Active Directory is impossible to implement in ways that assure robust security for especially sensitive stuff; obviously, a lot of shops manage to do just that. However, a lot of shops also think they can do so and wind up failing in the effort. (Some of them get breached and have these flaws vividly exposed, some just get lucky and never get attacked in any concerted way.)
The people who implement and run your AD setup may be good, but creating and continuously maintaining a domain environment with robust security is a really challenging thing. Can you say you're certain that your people or contractors are well-versed enough in infosec admin practices to compartmentalize their domain admin activities so as not to expose their domain admin credentials (ie. "the keys to an Active Directory kingdom")? To setup two-factor authentication--which you really, really want when protecting especially sensitive information of any kind-- with your current AD setup? I don't mean to prejudge the capabilities of the people who handle your tech setup day-to-day right now, but... well, in my experience small-to-small-midsize shops like yours usually don't have highly-qualified, security-savvy administrators in-house to properly manage AD in a high-security environment. And if you link your documents store to AD authentication your whole AD setup will need to be run as a heightened-security environment. Which is often not desirable.
There is one much simpler, arguably more secure approach which comes to mind but might or might not be appropriate depending on exactly how sensitive the info in those documents is: setting up an Office 365 account and storing your documents there with two-factor authentication enabled. I know one tends to hear about a cloud option for storing sensitive stuff and wince (I usually do the same), but in your case it might actually be a more secure alternative. One of your threat vectors, physical theft of the drives containing the info, is dealt with nicely by going-off premises, and two-factor auth run by Microsoft does not make the security of your documents dependent on your local AD domain being configured and maintained properly 100% of the time by your people or contractors. Also, you can set folder-by-folder access permissions for different users even more easily than your can with local folders & shares.
(Side note: Just to be clear I'm not shilling for Microsoft's cloud solution. Google's wares would also meet the OP's needs, as could those of Dropbox, or box.net, or etc. Office 365 just came to mind first because the OP has a Microsoft shop, and because that's where my personal skills and experience also largely lie as well.)