This is actually default behavior.
The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS).
So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests. If you attempt to login, but TACACS rejects your password, the local database is NOT consulted.
From: Juniper Authentication Order Methods
The password authentication method is not explicitly configured as one of the authentication methods in the authentication-order authentication-methods statement. In this case, the password authentication method is tried only if all configured authentication methods fail to respond. It is not consulted if any configured authentication method returns a reject response because of an incorrect username or password.
If you're seeing different behavior, check for the following configuration statement (be aware it has sub-options, for more info see Configuring Authentication Order):
R1> show configuration system authentication-order
If this is configured in the right way, the authentication database WILL be consulted if the TACACS server fails to respond OR rejects a password attempt.
The password authentication method (password) is explicitly configured as one of the authentication methods in the [authentication-order authentication-methods] statement. In this case, the password authentication method is tried if no previous authentication accepts the logon credentials. This is true whether the previous authentication method fails to respond or returns a reject response because of an incorrect username or password.
So to be extra clear, you do not want
authentication-order configured at all to achieve the default behavior.