Client VPN: Any way to require password authentication without AD?

It seems like with using the mutual authentication option for Client VPN, there is no way to add another obstacle to ingress for anyone who has the configuration file. Is this correct? I just wanted to make sure that's true before I tell the stakeholder.