It can’t do both, if you go complete local then all types of authentication are disabled and anyone on your same network can access Plex directly. The latter (PIN) would require Internet connection, so can’t be local.
You might wanna support this feature which when implemented will solve this issue: [Feature-Request] Built in local authentication server (prevent plex.tv outage)
