Users or groups who require access to 3270 sessions from workstations using SNA Server client applications must be members of the appropriate SNA Server subdomain, and, therefore, members of the Windows NT domain of which the subdomain is a part. Once they are enrolled in the SNA Server subdomain, you can assign specific 3270 (LU type 2) resources to the appropriate accounts. The users can access only the specific resources that you allocate to them.
Using domain security to authenticate users, then limiting their access by assigning them only specified resources, is the preferred way of maintaining security in your environment.