Set the following items on a group policy for an OU containing the computers you want to allow, i.e. TLD.local/Org/Workstations

Note that users MUST set up a Windows PIN before biometric methods can be used.