The correct configuration to achieve the requirement of checking a AAA server first and then a local username, with denial if both fail, is aaa authorization exec default group radius local none. This command specifies the order of methods to be used for EXEC authorization. It first attempts to use the group specified by the radius method. If that fails, it tries the local database, and if both methods fail, the none keyword ensures the user is denied access.