In general and knowing what role will play bastille in the system, has more sense to require networking than login.
This can also helps speeding up boot time if for instance some jails in bastille provide some kind of networking role like acting as a DNS server.
Change the pf.conf example in order to prevent issues (jails not allowed to access internet correctly) when the network interface has IP aliases. Many thanks to @cedwards and @chriswells0 for the hints.