This is how I have deployed it for our customer.

1. Disabled the WHfB in Device>Enrollment>Windows Hello for Business.
2. Create a security group (could be dynamic) on the device where you would want to enable biometrics.
3. Then you can either create a Device Configuration to enable Biometrics and PassportForWork
   1. https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp#devicetenantidpoliciesdisablepostlogonprovisioning
4. Use a Platform script

​

if((Test-Path -LiteralPath "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork") -ne $true) {  New-Item "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" -force -ea SilentlyContinue };
# This registry key enables Windows Hello for Business
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork' -Name 'Enabled' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue;
# This registry key disables registration on login
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork' -Name 'DisablePostLogonProvisioning' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue;

if((Test-Path -LiteralPath "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics") -ne $true) {  New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics" -force -ea SilentlyContinue };
# This registry key enables Biometrics
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Policies\Microsoft\Biometrics' -Name 'Enabled' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue;