The new group feature 'gui access' lets you change the default authentication method used for users belonging to this group. Main reason for using this is when LDAP or HTTP access is enabled, and you want certain users authentication via internal accounts or disable them completely.

Regardless of the system authentication method, users belonging to a 'gui access internal'-enabled group cannot log in.