User role weaker than authenticated user
This doesn't appear to be documented in the LoginToboggan interface anywhere but the default behaviour actually does what you want it to do.

You need to create new role like you mentioned, a pre-authenticated user. 
After creating the new role go to LoginToboggan config page and select this new role as your Non-authenticated role and save.
Now when you go back to the permission config page you'll see this new role is excluded from the authenticated user permissions, just like the anonymous user.