Thanks for the response.
The system is Ubuntu 14.04, running Ubuntu's Samba 4.3.9.
The Centrify package versions I'm running are the latest support at our site:
centrifydc 5.2.2-186
centrifydc-adbindproxy 5.3.0-504
I've set up adbindproxy as instructed in the documentation, so the "unified identity scheme" should be working. But really for the shared printers I'm trying to talk it into avoiding that: it should map to "nobody" when someone tries to connect to the share, preferably without trying to authenticate, alternatively with a harmless fallback when the authentication fails. I've tried "guest only = yes" but that doesn't seem to change anything. The only thing that changes anything is changing "map to guest," which changes the error seen on the Windows end.