I've done this before for similar situations. It requires some changes to master stored procedures - notably sp_MSdbuseraccess.
I'm not sure of the implications of applying service packs thereafter. Would the customisation prevent service packs being applied, or would it be simply a case of reapplying the customisation if a service pack replaced sp_MSdbuseraccess?
I have documented scripts around here somewhere. Probably to big to post, so let me know if you'd like them emailed to you.
Cheers,
- Mark