In this case, the type of exception is completely irrelevant, as long as it is caught, and the type of error is fed back properly. The conclusion is that an application login failed, and your process should be able to handle that. The rest is just flavour or for reporting purposes.
To me personally this would be a system exception though. For me a businessrule exception is any form of pre thought of process rule that can happen on a transaction. Expired or incorrect passwords would require direct action from an operator, while a failed transaction with a BE might only be the responsibility of some key user when it suits him/her. Using a SE here would indicate its urgency, as well as making sure the entire job gets a status failed.
Taking a soft BE approuch here and transitioning the end process normally might report the job complete, showing ‘green’ in Orchestrator, and nobody takes any action.
You do want to prevent any form of retry in it, since we all know what can happen to an account if you enter the wrong credentials a few times in a row. Since REF is the assumed main flow, and opening applications usually performed in the init part, it will transition to end process with any exception, so no special coding would be needed.
But hey, this is just ‘my’ preference 