Apple have decided to remove the GUI and the SACL Group for the Loginwindow ACL from 10.8
This means that if you bind a server to a Directory Server ANY user on that server can login to the GUI of your Server !!!!
However you can manually add the group back in, add users to that group and Loginwindow will pickup and use the SACL.
sudo dseditgroup -o create -T group com.apple.access_loginwindow -i 508
This will add the SACL group. Then use the Server app, show all system records and then add accounts to this group to control access.
You can add users via the command line too.
sudo dseditgroup -o edit -a auser -t user com.apple.access_loginwindow
will allow the user caller “auser” to login to the GUI