Can a User, who is part of "Protected Users" login to Netscaler Gateway without any additional idP? I would like to create PAWs for Tier0 and LDAP + Radius is not possible AFAIK (uses NTLM and not Kerberos).

nFactor, or setup a secondary gateway restricted to just that other authentication method.

nFactor with AD group extraction.

If you don't want to do LDAP first, you also can do an authentication choice drop down box. I use that in my Terrorform code so that in my lab I can demo all types of authentication methods.

Is your code on Github? Asking for a friend 🙃

Here you go. Bear in mind, this was build by and for people that never did advanced terraform. So it is pretty linear. https://github.com/jeffriechers/NetScaler_Terraform_Template

Nfactor flow with a ldap policy first with the checkbox Authentication disabled. After that you can create a decision block with additional policys based on the extracted groups.