That doesn't really separate the local database into two groups. The concern is that users in the local database have management access to the device - that config just points the new AAA method SSL_AUTHEN toward the local database that already exists. VPN users still have to exist in the local database and thus still have management access if management access is granted to local users.

As far as I know, IOS doesn't have any way to restrict specific users from specific services. You can define CLI privilege levels for individual users, effectively disabling all commands (see below), but you can't give some local users exec shell access while flat-out denying exec shell access to other local users. This is what RADIUS and TACACS are for.

--

username <username> privilege level 0 secret <password>
privilege exec level 1 enable

This sets the required privilege level of the enable command to 1, as opposed to the default of 0. It also creates a user with privilege level 0. The user will be able to SSH to the router, but won't be able to do anything:

R1>?
Exec commands:
  <1-99>   Session number to resume
  disable  Turn off privileged commands
  exit     Exit from the EXEC
  help     Description of the interactive help system
  logout   Exit from the EXEC

R1>

It's not an elegant solution, but it's the closest you'll get while still keeping the VPN users in the local database.

Aside from that, you should also restrict management access via ACL. That's a much simpler solution, assuming your management workstations have predictable IP addresses (they should).