Thanks for both of those suggestions. I guess the firewall option is slightly better in that it allows the user to still be logged in with their (cached) domain account, which may be helpful to them - they can make sure the firewall is using the "expensive link" profile before they "dial-up" with the satellite modem (is that how those things work? I have no idea).
Incidentally, if that's not how the satellite link works (i.e. if it appears to the client machine as an "always on" link, like normal broadband), then I'd say the firewall profile route would definitely be the way to go, since the profile could be set before leaving for the field, otherwise, starting up the laptop while it has the satellite link available would generate a good few quid's worth of traffic before you decided to login to the local account.
Also, using a firewall would allow you to very clearly define the traffic that was allowed to use the satellite. I was told the problem was ordinary DNS traffic costing money, but you could imagine a scenario where a user may accidentally leave something like bit torrent running and end up being charged a fortune! ;-)