I'ts not really possible to do that in plain ASP.NET. The <authentication> can only appear on the "root location".

But there is a conceptual challenge as well - which users should end up on the UI login page? But you've probably got the answer in "anyone who's entered a url like http://mysite.com/my-ui-path/whatever". We had that problem recently and tried to set up both Server.Transfer and Response.Redirect but the EPiServer login page seems to only work when "being" the login page set in web.config. Thus we need to set the EPiServer page as UI login in web.config but check globally and do a redirect when other users access the site. For this sake, you can eg. use a code behind for Global.asax and something like this:

protected override void OnValidateRequestAccess(ValidateRequestAccessEventArgs e)
{
   string url = e.Request.Url.AbsoluteUri.ToLower();

   if (url.Contains("/util/login.aspx"))
   {
      string securedPage = e.Request["ReturnUrl"];
      const string[] loginSegments = { "/ui/", "/my-special-ui/" };

      if (!loginSegments.Any(seg => securedPage.Contains(seq)))
         Response.Redirect("/MyCustomLoginPage.aspx?ReturnUrl=" + HttpUtility.UrlEncode(securedPage));
   }

   base.OnValidateRequestAccess(e);
}