Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.
username localadmin password xyz priv 15
aaa authentication login CONSOLE local
aaa authentication login VTY group tacacs+ local
aaa authorization exec VTY if-authenticated
aaa authorization exec CONSOLE if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting commands 15 default start-stop group tacacs+
!
line con 0
exec-timeout 5 0
logging synchronous
login authentication CONSOLE
stopbits 1
line vty 0 4
access-class MANAGEMENT-ACL in
exec-timeout 5 0
login authentication VTY
EDIT:
If the remote auth server is accessible standardUser and emergencyUser could log in to the device via SSH. standardUser would hit the remote auth server and the emergencyUser would auth to the local device.
I don't know of a way to do that, other than adding the emergency user to the auth server as well as being configured locally.
I'd like to avoid the emergency backup user from having to time out to the remote auth server in the event the network is having issues.
You can shorten the timeout. I believe the default is 5 seconds for newer IOS and 1 second for NX-OS.
Use the command
tacacs-server timeout x