It seems impossible to have both anonymous and non-anonymous access working together.
Steps I have taken:
1) Create Local Docker repository.
2) Set up reverse proxy
3) Deploy an image to the repository (as admin)
4) Uncheck Force Authentication in repository settings
5) Allow anonymous access in Security-General
6) Make sure "anonymous" has read permission on registry
Now docker pull works for anonymous, but docker login fails:
Error response from daemon: no successful auth challenge for http://127.0.0.1:5011/v2/ - errors: 
However, when I check the Force Authentication button, then login works ok, but anonymous docker pull stops working:
(no idea why the request suddenly switched to v1, but when I change the repository config to use v1, then this is what I get: )
a.a) 4.4.3: The same as 4.3.2