Under the firewall settings you can create custom roles with custom security, and QoS policies for each. It only seems logical that I should then be able to assign a local user one of the custom roles I created. I don't know what "if any" limiting factors there should be.