Choosing authentication method to work with ISA proxy

Choosing authentication method to work with ISA proxy

Given: 1. Client application supports only Basic authentication 2. When
client application runs from machine in the same domain with the ISA -
it's Ok. 3. When client application runs from machine that not belongs to
the ISA server's domain - client cant access to internet.
I know that ISA server can be configured to authenticate only with
integrated authentication method(I cant change this) But why it's work in
case 2 ?
Which method to choose to solve the problem with ISA proxy: 1) add NTLM
method to client or 2) add Kerberos method to client? I hope it will work
with ISA. It is portable. What are cons?