Currently both authentication type and access to frontend are combined in one field - in user groups "Frontend access".

There might be situations when user has no access to frontend, but it can still use API, which requires authentication. Thus such kind of setting might be misleading.
Propose to split these two settings, by creating checkbox with "Frontend enabled" and leave dropdown field named "Authentication type" with options System default/Internal/LDAP.