Reference:
https://docs.microsoft.com/en-us/mem/intune/enrollment/device-group-mapping

Explanation:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection?
view=o365-worldwide#anti-malware-policies

Explanation:

The correct setting is Enforce attestation . In Microsoft Entra ID authentication methods policy, passkeys
/FIDO2 can be configured so that attestation is required during registration. Microsoft states that when Enforce attestation is set to Yes , attestation is required at registration time, and Microsoft Entra ID can verify the authenticator's make and model against trusted metadata. This is exactly what the question asks for:
validating the passkey during enrollment by using trusted metadata from the FIDO ecosystem.
Microsoft also explains that Microsoft relies on the FIDO Alliance Metadata Service (MDS) to determine passkey/FIDO2 authenticator compatibility, and that vendors publish authenticator metadata to the FIDO MDS. When attestation is enforced, Microsoft requires extra metadata from passkeys registered with the tenant, allowing Microsoft Entra ID to validate whether the authenticator meets attestation requirements.
Enforce key restrictions is different: it allows or blocks specific passkey models or providers by AAGUID.
Allow self-service setup only permits users to register passkeys themselves. Restrict specific keys is not the setting that performs FIDO MDS verification during enrollment. References/topics: Microsoft Entra authentication methods policy, Passkey/FIDO2 configuration, FIDO2 attestation, FIDO Alliance Metadata Service.