Linux TACACS+ auth for SSH but allow users to use public key auth

we have running tacacs environment for centralised login to our routers, firewalls etc and even most of our linux boxes to ssh

what we would like to do is allow users to authenticate to SSH via public key auth rather than having to type there password in, but still authorize via tacacs to check that login is indeed allowed and access should be granted, but if the user is disabled in tacacs it should be rejected

is that possible and how would it be achieved - we are using RedHat/Centos with pam_tacplus

secondary related question: how would you allow specific system accounts to bypass tacacs authentication so that server to server scripts could run via SSH and public key auth without the need to exist in tacacs also