Can I only allow secure login on MacOS?

That’s going to be trouble, as Touch ID is a shortcut for the password. Not a replacement for it.

If you want to increase security: https://www.yubico.com/works-with-yubikey/catalog/macos/ (there are others)

Might also want a trip through the CSRC guidelines: https://github.com/usnistgov/macos_security

There are useful checklists (the STIG), too:

https://ncp.nist.gov/

https://github.com/usnistgov/macos_security/releases

I do not know the answer to your question.

HOWEVER, if you make the password very long (20-30 characters) and very complex (upper/lower case, numbers, special characters), then the likelihood anyone will guess your password is extremely unlikely. And your Mac is going to lockout attempts after several tries.

adaxus wrote:

Is there a way to disallow password login via the Lock Screen/Login GUI and only allow Touch ID or a physical token + PIN? I figure the likelihood is slim, but all the articles I've seen are for disabling the need for authentication entirely, which is the opposite of what I'm trying to do. I'm currently running Ventura 13.3.1 (a). Thank you in advance for any assistance.

Well you can do what we have to do with our government computers:

Full disk encryption -- requires password to unlock

+

CAC card, which is a physical token, which in turn requires a PIN

+

user account login, another password which can be long and complex

+

can be remotely wiped

It's a bit much, but if/when a laptop is stolen, it's useless to whomever took it because there is no way someone can get through all that and it is remotely wiped as soon as it is connected to the internet.

I don't think touch ID is all that helpful because it is just a quick way to enter a password, it's more of a convenience than anything else.