Let users authenticate
pass quick on $int_if inet proto { tcp, udp } to $int_if port ssh
Other rules could just as easily go in authpf.rules
pass quick inet proto { tcp, udp } from <authpf_users> to \ any port $udp_services pass inet proto tcp from <authpf_users> to any port $client_out