Works as we want

You can specify IP range. It’s perfect for a self-hosted extranet: intranet users is always authorized and extranet users need to login.
The only (and significant) problem is the incompatibility with the cache solutions I tried, especially WP Rocket.