When using Form Portal in self-hosted, a user can submit the form themselves while logged in, or anonymously if they aren't logged in. Your problem is going to be, if an authenticated user tries to access your form without logging into Laserfiche, Laserfiche would just see them as a valid unauthenticated user and allow their submission. 

Here's something to try:

You could create two different processes (one for authenticated users and another for public users), then merge them. 

1. Create your full process and full starting form as you have above and set it to private. Internal users will use this starting form and since it's private, it will require them to log in to submit. 

2. Copy that process so it creates the same form and set this one to public. 

3. In your public process, delete the entire process and instead, call a WF and pass all the form data over to it. That workflow should have one step "Invoke BP" and have it invoke the internal process set up in step 1. 

4. Give public users the link to the public process. 

This way, internal users would have their link that would force authentication. Public users would have their link that would allow them to submit without logging in and workflow would create an instance for them. 

This would even allow you to modify the internal/public forms separately in case you need to collect information from each of them differently.