add info to limit login to local login only

admin-guide/configuration/access/system_access.md

@@ -8,6 +8,13 @@ aaa::users:
   - '%unx-project_group'
 ```
 
+To limit a login to the physical desktop/console only you can add a `:LOCAL` suffix like this:
+```
+aaa::users:
+  - 'muster_h:LOCAL'
+```
+
+
 Note that administrative users (see below) always have normal access without being explicitely listed in `aaa::users`.
 
 ## Administrative (root/sudo) Access