First of all, I'm pretty sure you're using the wrong tool for the problem at hand. Instead of defining additional guards, you should make use of user roles to authorize different parts of your application. Refer to this excellent blog post from Martin: https://martinbean.dev/blog/2021/07/29/simple-role-based-authentication-laravel/
A guard is simply put an object that is responsible for extracting user information from a request and translating that information into an existing entity/model in your application, which will be an Authenticatable instance in most cases (not necessarily though, e.g. in Sanctum). Whenever a guard is able to translate an incoming request into a user object, it deems the operation successful and thus authenticates the user sending the request. The authentication itself happens in a middleware named... you guessed it: Authenticate. It spins through provided guard names and if there is any match, sets the found entity as the default using the shouldUse method. At that point, you're authenticated.
The reason why you have to change the default, is because the every auth call falls back to the default guard set in the config file. If you don't change it, you will have to provide the guard's name with every call you do to the AuthManager e.g. for retrieving the authenticated user's instance using auth()->guard('customuser')->user().
TL;DR Use a different guard if the means by which you have to authenticate differ from the default password based one:
- Biometric auth using Webauthn
- Passwordless auth
- Token-based auth (.e.g. an API endpoint)
