It turns out that it was staring me in the face all along... there's a new method mentioned right inderneath the standard Login() method in the online VMware API reference, called LoginBySSPI().
But using it isn't quite as straight forward as replacing Login() with LoginBySSPI() on it's own... you first need to grab a security context via C++ and pass that as an argument to LoginBySSPI(). I can barely read C++, let alone write it, so I need to get my head around the easiest way to use it. When I work that out, I'll post back a few samples from the VI SDK using LoginBySSPI() instead of Login(). Unless someone like Andrew Kutz happens to read this and expend 0.00001% brain power to provide the answer :-)
I'll also be asking VMware when SSPI will be moved out of 'experimental support' status... things like VCB could really benefit from it, as could a raft of other 3rd party apps.