They don't have a right to scrape password protected personal data off an intranet, and AA also have the right to attempt to block an app or its scrapers regardless of whether the scraping is legal or not.
In this context blocking scrappers is probably legal for AA. However it might be illegal in other contexts, such as if there are any concerns around disability.