My recommendation would be to build a separate Terminal Server for the thin clients. These systems would be configured to invoke a Remote Desktop / Remote App login as soon as they come online, giving the illusion of a Windows Desktop that is actually an RDP session.
This way, the users can log into their own accounts (perhaps with a roaming profile as you stated) but the desktop session on the thin client would actually run on the terminal server rather than on the local system. If they log into their own machine, the domain will recognize that they're logging in interactively, rather than a terminal session.
One could also create "kiosk" accounts for guests, that can also be logged into as terminal sessions; these can be locked down more rigorously, perhaps not allowed as interactive (local) login, restricted to thin clients only, etc.
And yes, it would be Considered Bad to run terminal services on a DC, especially with guest accounts active. Your DC is going to be the central hub for all administrative access, so keeping it at arms length from the terminal sessions is highly recommended.