This is more a solution to what I'm trying to accomplish than an answer to the question I asked. If somebody has a more direct answer to the question asked, please contribute it.
Thanks to the good people at CERN and Ubuntu for getting me on the right track:
Apparently the package nss-pam-ldap for using LDAP in the NSSwitch for providing /etc/passwd allows to do some filtering or overriding of values (though I haven't tried this yet). This could be useful if normally your LDAP users' homedirs are on NFS, but on a specific host, you want them to have local homedirs.
# Set the user homedirectory to /home/$USER
map passwd homeDirectory "/home/$homeDirectory"
Or map to nologin for maintaining correct file permissions on an NFS server (without allowing LDAP users a shell)
# Set the login shell to /sbin/nologin
map passwd loginShell "/sbin/nologin"
Some basic filtering
# Only get users from group 1160
filter passwd (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*)(gidNumber=1160))
More stuff can be done with the ldap configuration itself (/etc/ldap.conf or /etc/openldap/ldap.conf), for instance adding a user attribute: host to the LDAP users, where you have a host attribute (with hostname) for each host the user can access, and lines like this:
For more info, just follow the links I posted at the top, and if I have some time to get all this stuff working in a way I appreciate, I'll try to clarify this answer a little bit.
EDIT: the main website for the nss-pam-ldap package is here:
it has some documentation for the nsldc.conf file