It depends whether you want to restrict the access within the admin app or on the live site. If it is on the live site, then you need to configure you live site app accordingly and add the check into the controller(s). The setting you mentioned just sets a bool property which then returns true/false - so in the code you can see what page should be checked for authentication. More details on how to implement access check can be found here.