We had something similar up in this forum post. You could try to solve it by intercepting the default handler.

In your case you could check whether the user is authenticated and has no roles. If that is true, then the user must have come here because of missing rights, not missing authentication. So you can redirect or rewrite to a different page and skip the default handling (which triggers OWIN to attempt authentication).

Any direction on how to implement our own EPiServer.Web.IAccessDeniedHandler? Inheriting it doesn't seem to pick it up.

You would need to intercept the implementation, like documented here.

Basically you create your own additional logic and return from the method if you handle it. If your method not handle the scenatio, then you call the default implementation and let it do it's job (as a fallback).

So I implemented it as so:

public void ConfigureContainer(ServiceConfigurationContext context)
{
var container = context.StructureMap();
var services = context.Services;
services.Intercept<IAccessDeniedHandler>((locator, defaultCache) => new RoutingExtension(defaultCache));
//
//
//
}

Set up my own:

   [ServiceConfiguration(ServiceType = typeof(IAccessDeniedHandler))]
    public class RoutingExtension : IAccessDeniedHandler
    {
        private IAccessDeniedHandler _defaultCache;

        public RoutingExtension(IAccessDeniedHandler defaultCache)
        {
            this._defaultCache = defaultCache;
        }

        public void AccessDenied(HttpContextBase context)
        {
            var a = context.User;
        }
    }

But the AccessDenied method is never hit?