I have done some research on the topic, but I can't quite find a straight answer to my question. Please tell me if my understanding is correct.
Kerberos can be used as the bridge between a Linux/Unix OS and the Windows AD. Policies (e.g. user/group 'A' has access to resources 'X' and 'Y' but not 'Z') can be set in AD and Kerberos enforces these policies. So a RHEL server can have user accounts without passwords (i.e. locked accounts), but these users can still authenticate to the server if Kerberos directed by AD policy says they should have access.
My concern is that a Linux account without a password in the shadow file can be granted access if they are a member of the AD domain, but no longer should have access to the Linux server. In an unrelated organization, I have bound an iMac to a AD and any member of the domain can access the iMac.