To achieve your functionality :'user selects log-off , the browser window will automaticlly close. ' please use this OOTB HTML fragment -  UserWorkForm to automatically close window after the user logs off from Pega. 

<script type="text/javascript"> function closeWindow() { setTimeout(function() { window.close(); }, 3000); } window.onload = closeWindow(); </script>

You can use this HTML fragment to do a lot of other browser behaviour modifications like disabling back buttons etc. But remember the behaviour may be restricted only IE browser only.

To answer your point # 1: there is no relation with the log off and the prpc:unauthenticated ag. since this ag is configured to work in sync with the authentication service only. By default the access role provided to this AG is prpc:guest; hence this user will not be able to do almost anything (execute sql statements,service calls etc.) - dont confuse this ag and with the application ag; the unauthenticated ag is only required for the process of authentication where the rules should belong to the enterprise layer and should never have access to the application specific code.

To your point # 2 you should create an application specific unauthenticated access group which you can manipulate as per your requirement; as many application requirements need some kind of changes/modifications during the login process itself.

Hi,

Based on your system name need to change the requestor. If your system name is Pega then you could modify the access group in Pega:Browser.