With regards to joining the domain, this is a one-off operation I'm happy to do with my own admin account - I was more interested in the account used to perform the authentication on an ongoing basis (which I would prefer didn't have AD joining privileges).
Right now a normal domain user seems to be getting sufficient access to do this via the Authenticated Users permissions on the top level domain object so fingers crossed that's all there is to it.