Does anyone have recommendations on what to do differently, or a checklist, when setting up an Exchange 2003 mailbox for outside consultants? I assume I still need to create an AD user?
Only webmail will be needed.
All mailboxes in Exchange require an Active Directory user account be created, since the mailbox is, effectively, a property of the AD user account.
If your concern is limiting the use of these accounts to prevent access to shared file resources on server computers you may have a large task ahead of you. If you used a lot of "Authenticated Users" in permissions you may regret it.
You could limit the usefulness of these accounts a bit by placing the users into the "Domain Guests" group, setting that as their primary group, and removing their membership from "Domain Users". That will cause them not to be a member of "Users" on member computers in the domain and, depending on how you've done your shared folder permissions, may also limit their access to shared folders.
You could make a "Consultant Users" group and go around applying "Deny" permissions on resources with that group, too, but that's messy. (It's generally bad form to use "Deny" permissions unless you can't accomplish what you're looking for with the implicit denial capabilities of the underlying security model.)
Are these consultants going to be logging onto your company-owned PCs inside the domain? If so, then Evan is correct.
Another option to this is if they are going to be bringing in their own computers, and connecting to your network or connecting to webmail over the internet, you can set a group policy to deny local logon on the OU that you set the consultants in.