Harden a public login to only let it retrieve a list of other logins, and do nothing else
"Most secure" is an ambiguous statement that needs more explanation. You need to think about what kind of attack vectors you are trying to mitigate.

For example, what if a malicious user trys to brute-force your built-in account? It's going to be locked out. This creates a denial of service scenario, as normal users cannot receive a list of valid accounts either. If you were trying to mitigate a DoS scenario by using hard-to-guess logon names, you just shoot your own foot.

Hard-coding a password in your application will make it insecure. First, it can be extracted from the application, no matter how you encrypt it. That's exactly the way Blu-Ray encryption was broken. Second, should you need to change the password, you need to ship new binaries to all the users which is somewhat a hassle.

How about creating a SSIS package that publishes a list of valid logins on a network share? This moves some security configuration from the database to your AD group membership maintenance.