subweb or new site

I have a 'hidden' website I want to put out for a few people off of the main
site. I'd like it to be something like www.site.com\hidden. I will
password protect it later. What is the proper way to do this...create a
subweb, do another site with different IP address, or alias of some kind? I
can get it to work, but want to do it the proper way first.

Also, what are the best methods for password protecting?..convert to PHP or
use IIS? There won't be a lot of users but they are not local domain users.

Thanks
Ryan