The user must have a CMS user ID for local, LDAP, and/or enterprise login methods. This applies even if the login method used does not prompt the user for their user ID, for example as with an enterprise login.
If you want to restrict a user to the enterprise login method (web client only), do not assign a valid Linux password when you create the new user and do not set up LDAP authentication for the user. The absence of a Linux password and LDAP authentication blocks the user from logging in using a local login.