You are mostly correct in understanding that with auto provisioning enabled, any user on AD will be auto-provisioned if the log into Viewpoint.  The one caveat is that the user must match the DN Pattern Bind or User Search that is configured in the Viewpoint LDAP Servers admin portlet.  That would be one way to limit the users that can log into Viewpoint.  I do realize that depending upon the structure of your AD this potentially provides little or no value, assuming that many or all of your AD users are in the same location in AD.
The better answer to this question is to use the "Automatically assign these roles" option in the auto provisioning section.  The only role that Viewpoint will automatically assign to an auto provisioned user is the "User" role.  By default Viewpoint ships with this role having absolutely no access to any features.  Being a member of this role only gives you the ability to log in.  So only configure the "User" role to be assigned to your auto provisioned users.
Then as you suggest, you would want to map your "Viewpoint-User-Access" AD group to some Viewpoint role that provides whatever permissions you would want to grant by default to a basic Viewpoint user.
Note that we do have a feature request opened to provide the ability to limit the scope of users that are auto-provisioned.  However, this feature is not yet targeted for any particular release of Viewpoint.
Hope that helps!