8.2 is starting to move in the right direction finally for RBAC but as you said the web GUI doesn't support all workloads yet. I would highly advise staying far, far away from NBAC, you're more likely to break something than you are to get it working to your satisfaction.
Stick with auth.conf for now - it's not perfect but it's also not going to cause you to reinstall either. =)
Easy keyword reference for auth.conf entries :
# User access keywords for ADMIN GUI
# ALL = Everything
# AM = Activity Monitor
# BMR = Bare Metal Restore
# BPM = Backup Policy Management
# BAR or JBP = BAR access
# CAT = Catalog
# DM = Device Monitor
# HPD = Host Properties
# MM = Media Management
# REP = Reports
# SM = Security Management
# SUM = Storage Unit Management
# VLT = Vault Management
# User access keywords for JBP/BAR GUI
# ENDUSER = Restore from true image or regular backups, plus redirected restores
# BU = backup tasks
# ARC = archive tasks
# RAWPART = restore raw partitions
# ALL = all backup and restore actions
Examples :
user1 ADMIN=AM+BPM+DM+MM+HPD+REP+SUM+VLT+BMR+CAT
user2 ADMIN=JBP+AM+BPM+DM+MM JBP=BU
user3 ADMIN=ALL JBP=ALL
user4 ADMIN=AM+BPM+DM+MM+HPD+REP+SUM+VLT+BMR+CAT
If you absolutely get forced into NBAC, set it up in a test lab first, load a copy of your prod catalog into it, and attempt to configure things - add users, add permissions, modify stuff, etc. See if it meets your needs. But whatever you do don't just enable it in production and expect everything to be sunshine and rainbows.
Best of luck.
