Should I be adding rules to ensure trailing slashes for this style of url, and forcing everything to lower or is that going overboard?
Obviously if we are moving to a new structure we want to do it once and do it right first time.
I am setting canonical tag in each page, and also going to put a 301 in if the incoming URL doesn't match what I expect. Oh and 301s from old style URLs to new. Also in the rewrite module I can set a canonical rule for overall urls to always include the www or not.
Does that sound like a plan or a recipe for instant traffic massacre?!
it's the Windows Server OS that is case-insensitive by default, which is a perfect example of why you should look away from MS for proper implementation of HTTP protocol or best web practices.
so yes - "out of the box" it will happily serve 200 OKs for 2**N - 1 non-canonical casing combinations but that doesn't make it optimal or correct or recommended. the search engines are where it gets "real world" here and they will index those as different URLs which means duplicate content. your browser won't style your anchor text as "visited" unless the casing of the url matches.
windows server is not the "real world" - it's more like disneyworld.