I think initial login is via your UI.com account, and then it's very easy to disable cloud login and create local-only admin account, as well as completely disable remote access via unifi.ui.com.
I must say this is a bit of an extreme/maximalist position to take - I agree being local only by default, or having the option to choose during setup would be better, but the option is there.
