When using a local functional account, every host then gets a unique password.  In password safe under the functional account configuration, that is where the first password would get set.  After the system is onboarded, that individual managed system has a unique functional account password.  From there on, you must go to the managed system to update that specific functional account password, should you ever need to.

For Local scan account, I’ve found the best way is to pick a server and a scan account name.  That account name must be the same on all the other hosts.  Once the “master” host has the account onboarded, enable that account for scanning.  When you onboard every other server, sync the password of the scan account to the “master” host.  This way, you can have one credential for scanning all the assets with only one scan job.  If you don’t sync the passwords, then there is a unique scan account for each host requiring a unique scan job for every host.