Mark,
This is not really an answer, just some thoughts. I think you need to break down what you are trying to do into separate chunks:
- user authentication vs domain logic - do you need the same User object for both? If so, I guess you need a full, eagerly-fetched one, because that is what you will likely need for domain stuff - even though you might not need that for authentication
- do you need deep, nested equals on your entities, or is it good enough to just compare identities?
- when adding new users, attach them to the graph (call save) first, so they get an ID - before you stick them into collections and use them in domain logic
I always find simpler/ dumber/ less sophisticated/ less re-used code is easier to reason about and change
