I'm running 9.101 and I've Checked "Touch ID" so it shouldn't show up on setup after enrollment with DEP in PreStage Enrollments.
And I've tried using a script running at enrollment complete to do a defaults write to com.apple.SetupAssistant to set DidSeeTouchIDSetup to true (in the user template), but that doesn't seem to get picked up.
But as soon as a user logs in, there it is. Is this a bug, or am I missing something.