Enabling login of users who are not in the users database and yet whose certificates are still valid.

I just like to ask if there any other alternative means to support this feature, without the need to remove the [DEFAULT Auth-Type := Reject] part of the users database? or is this necessary to support the login of users who are not in the users database and yet whose certificates are still valid...? Please do tell me if you have any other kind of implementation in mind for this feature, as it conflicts with the huntgroup restriction of users... Thank you!