To let sshd supports RADIUS login, create two common PAM settings and adjust PAM setting of sshd so that user can enable/disable RADIUS authentication in will.
To map non-existed local users when login with RADIUS credential, adjust NSS settings so that the user will be mapped to radius after accepting RADIUS credentail. The libnss-ato is used for this.
Create admin aaa series commands to let user to set and enable/disable RADIUS authentication settings.