Our userlist doesn't change *that* often. So I'm just setting up a nightly cron job to:

getent passwd | grep HQAMOR > /etc/samba/winusers

then have a smartuser director with:

condition = {$lookup {HQAMOR+$local_part} lsearch {/etc/samba/winusers}{yes}{no}}

Let me know if anyone sees a better solution...