Chase: I'm too deploying Lion in masse, I was wondering the same as you and I found on Profile Manger's help (About the user portal->Providing configuration profiles for download->Enrolling devices): "If you use Profile Manager as a mobile device management server, the user portal allows users to quickly enroll their devices. In Profile Manager, select a user or group, then click 'Can enable device management.' Provide your users with the user portal URL. To see the URL, click View User Portal in the Profile Manager pane of the Server app. It is similar to example.com/mydevices. When users log in, they click the Enroll button to download a configuration profile that initiates the enrollment process". As to prevent users to vandalize your settings, you can add another payload to your profiles to keep users from opening Profiles pane on System Preferences, Everyone group seems good to do this.

I'm too deploying Lion in masse, I was wondering the same as you and I found on Profile Manger's help (About the user portal->Providing configuration profiles for download->Enrolling devices):

If you use Profile Manager as a mobile device management server, the user portal allows users to quickly enroll their devices.

In Profile Manager, select a user or group, then click 'Can enable device management.' Provide your users with the user portal URL.

To see the URL, click View User Portal in the Profile Manager pane of the Server app. It is similar to example.com/mydevices. When users log in, they click the Enroll button to download a configuration profile that initiates the enrollment process".

As to prevent users to vandalize your settings, you can add another payload to your profiles to keep users from opening Profiles pane on System Preferences, Everyone group seems good to do this.