Different policies based on user token

Hello, I’d like that a new user sees the email token wizard at first logon but, after it, can’t
find the “Email” option on the “Enroll new token” select field.
Is it possible ?
I’ve tried a lot with policies and conditions on token, but without success, the “Email” option on
the select field is always present

A user is always allowed to enroll a token type, if you allow to enroll the token.

There is no distinction between enrolling in the wizard and enrolling after the wizard.

If you want this very special behaviour, you can develop your own self service portal.