Hi,
You can configure different authentication methods depending on the access method, so console, vty and aux can have their own policy in terms of using internal or external authentication and permissions.
Via RA VPN, the users will not connect to any of these ports (if the router is terminating the VPN itself).
You can configure different policies for different VPN users.
If you need more information let us know.
Federico.