You'll need something like this using sysadminctl:
sysadminctl -secureTokenOff <username> -password <user password> -adminUser <admin user> -adminPassword <admin password>
Where <username> is the user name of the user you want Secure Token turned off on
<user password> is the above user's current password on the Mac
<admin user> is an admin user who holds a Secure Token
<admin password> is the above admin user's password
The problem with this is that you need to know the user's current password, and also have an administrative user that has a Secure Token as well. It's hard to fully automate this when you won't know what the end user's password is going to be. You can reset the password of course, but then their Keychain is either reset, or no longer accessible (can't remember right now):
sysadminctl -resetPasswordFor <username> -newPassword <new password> -adminUser <admin user> -adminPassword <admin password>
For our use case I ended up having a large script that manages particular user accounts, and worst case will end up prompting the end user if needed to enter their password in a Swift Dialog box, but that's an extreme case. Most of the time I use this before handing the device off to the end user to ensure they get a Secure Token and can enable FileVault.
We do not use an IdP on Macs yet, so things will change a lot when we do in terms of managing Secure Tokens and password resets.
