BLE Advertising after pairing not working (BlueZ 5.69)

Question

I have the following problem. My goal is to implement a BLE peripheral which first pairs with a device and afterwards advertises services and lets only the paired device access the values of the characteristics. So I am using simplePairing mode, and expirience the "Command dissallowed" error when trying to start advertising when piscan is activated. When I deactivate piscan I am able to advertise but not to find and pair with the device.

Can you pleas help me to find the right combination of setting to implement the wished peripheral? Is it even possible?

I tried almost all combinations and sequences. I tried to set the charcteristic flags to "encrypt-authenticated-read", "encrypt-authenticated-indicate" to enforce pairing/bonding after connection.