Smart card–only authentication using user-based enforcement?

Here, I’d probably use a separate macOS install in a second partition, or a second install on a second bootable device, or run one of the two environments as a guest in a virtual machine, or acquire a second Mac.

A little related history: in higher-security environments such as defense or military or classified environments, you’re trying to run what would be called “multi-level” or “compartmented” security on this Mac, and that gets gnarly to set up and manage and even to use. Various major vendors tried to build multi-level security systems in the 1990s too (MLS was a thing in US classified and defense environments back then), and they all basically gave up. Most customers—when faced with that requirement—decided to run multiple so-called system-high environments.

Running two environments is obviously more work to upgrade, but means you can chose when to upgrade each environment. Install only what is needed in the higher-security environment, which reduces what can be attacked.

Ensure your entire sensitive install is encrypted with FileVault (T2 or later works very well here), and ensure your backups are encrypted as well. If you have a T2 or later Mac, that works with the internal storage only, but does not assist with the performance of encrypting external storage. That’s done through software.

In short, a second Mac is probably going to be cheaper, in terms of your own time and effort, and easier to secure.

A guest or a partition or separate storage is easier to manage and maintain at the IT scale you’re operating at here.

I am familiar with and develop for and manage enterprise servers and networks, have developed operating system code and tooling for non-discretionary security environments (mandatory access controls), and would not follow your current path; of trying to compartment the data.

Maintaining separation over the lifetime of the data is hard. It’s far easier to entirely dispose of the (isolated) data here for instance, if or when that erasure becomes necessary. Nuke the guests or partitions, and nuke the backups, and the data is (probably) gone.

If you do decide to continue upon your current path, Apple has added security key support for Apple ID, and security keys also work for macOS logins.

That Apple support article doesn't say anything about mobileconfig files. It says MDM or sudo defaults hack. It sounds like you are trying to fake out an MDM with a mobileconfig file. Sounds like it doesn't work.

I recommend using the standard procedure documented in that article.

Also, you sound like you've had extraordinarily good luck so far. Smartcard login is something that regularly breaks with each major, and often minor, software release.

MPM23 wrote:

The third solution would have been logging in on my Mac with my password/fingerprint and Apple then giving me an authentication code through a second device (iPhone). As I understood that doesn't exist for Mac, only for AppleID. A smartcard is therefore the last resort.

Here, a hardware token—Apple calls those security keys—can provide the second factor for the macOS login, as was discussed above.

You are correct that Apple doesn’t support SMS as the second factor for macOS logins, but—if your data is sufficiently sensitive—you probably don’t want SMS involved in the mix anyway.

Easily and reliably disposing of the data is an oft-neglected but central part of this whole discussion, too. Apps and app removals can leave sensitive data in temporary files or log files or configuration files or keychain or such; in what amounts to detritus. Deleting a partition or deleting a guest deletes all that.