I'm just getting started setting up a test sync to see if mirrorsync will be our solution.  I haven't seen anything yet that indicates whether the security stuff gets sync'd (additions to list of users, or changes in a users privileges).  Is this part of what mirrorsync does?

MirrorSync is not able to sync any sort of structural changes, such as layout changes, scripts, new fields, etc. This would include changes to access privileges and accounts. The only way for offline users to get structural changes is to get a new offline file.

With that said, you can use the MirrorSync customization script to dynamically control which records your users receive when they sync, without having to distribute new offline files.

Thanks Jesse.  Your last sentence intrigued me.  We have a large set of customer data spanning the entire country.  We have sales reps that cover specific geographic regions.  Currently they only have a slice of the customer data that pertains to their region.  It sounds like we can use some sort of dynamic scripting to ensure that the sync only includes their specific region and not the whole country.  Right?  Exciting if it's true.

Yes, it is very easy to limit which records are synced for each user. Read this section of the advanced docs: http://docs.360works.com/index.php/MirrorSync_advanced_topics#Customizing_MirrorSync