Deny administration paths externally? /if/admin/?

**Describe your question/**
Since authentik runs as an SSO provider for external users to authenticate, it has to be exposed to the internet.
In my use case, only local users should have administrator access.
External users should only be using authentik to sign into preconfigured applications/services.

In order to accomplish this, which paths should be restricted to the internal network?
Rather, which paths should be exposed to the internet, so external users can only authenticate, without being able to access any administration areas of authentik?

- authentik version: [2023.6]