You can choose to not use .htaccess/.htpasswd, but instead, hook into vBulletin (probably at global_start), and create a login prompt by sending headers, then running the normal login checks to see if the user is authenticated.
Thanks for all of the input. Your post started me thinking about this and it became obvious that I was going about this the wrong way. I did in fact DUMP the .htaccess/.htpassword usage. I must have logged into my admincp 100 times yesterday, not realizing the answer is right in front of my face. The admincp login and redirect on failed login is exactly what I'm looking for.
Basically I created a similar login based on the AdminCP login. Then I set VBPortal and VB permissions to Deny All for everyone except Admins, Super Mods, Mods, Registered Users, and My Custom Groups.
You were right on the money, global_start was the key for triggering it.
Thanks again man! Sometimes you just need a third party view on these things.