Creat a test user with no access permisions
I would say to create a role that has access to content, grant that to the existing users, then uncheck "access content" from the 'Authenticated' role. This will also allow the system to know that even if a user is logged in, this does not grant them special privilege until they have an elevated role assigned to them. 

The authenticated role should be just a starting point for a user that logs in. I never leverage it for granting permissions in a way that would make it a 'unique' role - just make that role. Otherwise you are going to have to jump through hoops with code which can be easily avoided by creating a few roles.

You can assign a user multiple roles. During authentication, I take it you can figure out how or what role to assign to them. Every authenticated user will get the 'authenticated' role by default.