Check E1Suave's answer for some good starting points.
One extra tip I can give you from my personal experience is to (re)consider if you really need your clients to authenticate to the Open Directory (OD) at login.
The two reasons (I can think off) where you might want to do this are:
1. Network Home Folders
The home folder is automatically synced from and to the server, which can be very convenient when a user switches computers and still has access to his files.
The bad side(s): I found the syncing very buggy. Somehow conflicts would arise which needed manual intervention or the home folder would no longer be synced. Also considering how easily you can use cloud services like Dropbox, Google Drive etc for the same purpose, I personally find the network home solution inferior to modern day solutions.
Related to the above, my users relied too heavily on it, leaving them unable to work on files they modified at home because they didn't sync properly.
And finally, typically a user only works on one computer anyway. For files that should be available on the server for multiple users, you would set up network shares. Also, while the network home folder will not get mounted automatically on the client computer, it can still be made available as a network share for the user to manually put some personal files on there.
2. Restricting user permissions
This might be a valid reason to do OD authentication and it sure looked like a great idea to me at first. You can extensively configure permissions for your network users and computers in the Directory Admin tool.
The bad side(s): in the end we work in a very small environment with not that many users (and that's typically the environment where Mac OS X servers are used anyway), and setting up all these different permissions was too much of a nuissance for me, with no added benifit.
When you restrict a user, you need to make sure the extra support requests you will get because a user can't do something he needs to do at any given time, outweigh whatever mischief the user could/would do on his computer without these imposed restrictions. I personally only got support requests from the users with restricted access, users with a local admin account could do their work just fine without my intervention.
When you don't need directory authentication at login
Even if your users login to their computer with a local account, they can still authenticate to file shares seperately with their directory login (and save the credentials in their keychain). You can still use the directory to easily manage these users and their groups. I personally use the Mac OS X server for file sharing and VPN access, but when setting up a user's laptop, I just create him a local admin account on his machine.