@David Dartnell, Thanks for posting in Q&A.
Based on my research, I find if the device is Azure AD joined, Windows Hello works like you have experienced. If it's not explicitly disabled, it will get forced on the users.
You can select the disable option in Windows Hello for business to see if it will bypass.
Hope it can help.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.