Thanks Matt; I appreciate the quick response!
I’ll have a look at building out a plugin to handle the token-based authentication – it’s not as robust as building a central authentication server, but it has the benefit of being a whole lot simpler and therefore a whole lot quicker to build and get into production. 
Down the track, we’ll look at a central authentication server; we’ll likely need something like this for other work in the future, so it’s probably not a bad idea to avoid painting ourselves into a corner.
We would resolve username collisions by making the username the email address – if someone owns the same email address at two instances, they’re the same person. (We don’t do email address ownership verification, but for our particular use-case, that’s less of an issue; we’re deployed into schools, and staff and student email addresses tend to all be within the same domain and thus “owned” by the school.)