Hi Nick,
My hart goes out to you and your company for having to deal with this. However I do believe that you should use a 302 redirect along with a no flow just to be certain. Here's some more information.
http://blog.hubspot.com/blog/tabid/6307/bid/11285/SEO-Are-Nofollow-Links-Still-Valuable.aspx
http://moz.com/blog/nofollow-is-dying-the-impact-of-microblogging-and-nofollow-on-seo
Google lists the three main intended uses of nofollow as:
- Linking to untrusted content
- Paid links
- Crawl prioritisation (typically linking to yourself with nofollow)
Leaving aside for a second the ability / likelihood of webmasters using nofollow correctly (which means that the search engines need to work even with broken implementations just as they often rank HTML code that doesn't validate), there are two big uses of nofollow that are breaking the model:
- Complete "silo-isation" of large sites
- Domain owner not trusting trusted content authors' links
"Silo-isation"
Disregarding the fact that I just made that word up, there is a very real trend of powerful sites nofollowing all (or nearly all) outbound links even though they are the very definition of editorial links. The site owners have presumably seen the ranking power achieved by Wikipedia nofollowing all outbound links and are trying to form their very own black hole.
Lack of trust
My understanding of the original intent of proffering nofollow as a solution to the problem of linking to untrusted places was that it was mainly intended for situations like blog comments, profile links, etc., where users of your site could create links to wherever they pleased.
This is definitely valuable (as anyone who has ever had to moderate blog comments can attest) but what about once you do trust the commenter? Since so many sites have no mechanism whereby that nofollow is ever removed, we end up in a situation where people are creating huge amounts of really valuable content and the links they create are nofollow.
Sincerely, Thomas