Most of the built-in IIS authentication methods use Windows accounts in some way or another, so if you don;t want to do any major work for this, you are going to have to use these -- you will want to create accounts that are reasonably locked down.
It is usually sufficient to:
- create a group (e.g. Web Users)
- add the individual accounts to that group
- remove the accounts from Users (which effectively gets rid of a lot of the default permissions)
- give the Web Users group read permissions to the web site folder (and selectively any modify permissions required -- e.g. upload directories)
- add the group to the relevant 'Deny...' entries in Local Security Policy / User Rights Assignment
Optionally, you might want to add recursive deny full control ACEs for that group to the disks, registry hives and any other DACL-driven resources -- SetACL should be able to do most of them (see http://helgeklein.com/).
If you really must use a custom list of users, then (as @BrentPabst said) Forms Authentication is the only real way (see http://msdn.microsoft.com/en-us/library/da0adyye.aspx), but you will need to create the ASP.NET login page.
I've not tried IIS Manager Authentication but, from what I can see, it only applies to FTP sites, not Web Sites.