You can effectively disable Windows Hello for Business by launching certutil.exe -deleteHelloContainer on the end device under a user account, and then restarting the device.