code: private function loadFrontendUser(string $username, BackendUser $backendUser): ?FrontendUser
      {
          try {
              $frontendUser = $this->userProvider->loadUserByUsername($username);
  
              // Make sure the user provider returned a front end user
              if (!$frontendUser instanceof FrontendUser) {
                  throw new UsernameNotFoundException('User is not a front end user');
              }
          } catch (UsernameNotFoundException $e) {
              if (null !== $this->logger) {
                  $this->logger->info(
                      sprintf('Could not find a front end user with the username "%s"', $username),
                      ['contao' => new ContaoContext(__METHOD__, ContaoContext::ACCESS, '')]
                  );
              }
  
              return null;
          }
  
          $allowedGroups = StringUtil::deserialize($backendUser->amg, true);
          $frontendGroups = StringUtil::deserialize($frontendUser->groups, true);
  
          // The front end user does not belong to a group that the back end user is allowed to log in
          if (!$backendUser->isAdmin && !\count(array_intersect($frontendGroups, $allowedGroups))) {
              return null;
          }
  
          return $frontendUser;
      }
docs: Loads the front end user and checks its group access permissions.