>Kerberos?

Yes?

>Smart cards!?

Yes!? Or a YubiKey.

>What if I have less than a full team of full time employees able to be put aside to implement a solution?

This used to be something a middling UNIX sysadmin could configure and manage. You can also pay for someone to help you implement/manage a solution for this. Though I admit it may be overkill.