There doesn't seem to be a way to disable auto-enrollment of Thunderbolt devices
GNOME and Bolt are really neat! Though I can't find a way to prevent Thunderbolt devices from being auto-enrolled.
This code suggests the only criteria is that the screen is unlocked and it's not the login screen. (I suspect you have to be an administrative user too in some other code path.)
It'd be good if one could disable auto-enrollment even if the screen is unlocked, for the more paranoid IT security policies :)