Generate a fingerprint when a user logs in to a particular device for the first time.
Save this fingerprint in the keychain with the with the value "kSecAttrAccessibleWhenUnlockedThisDeviceOnly" for the "kSecAttrAccessible" key.
Things to consider,
Item will keychain will persist even user deletes the app
Keychain Items are backed up and restorable even to other device by since you using the above key the fingerprint would not be restored to the other devices.
If the devices ownership is changed then replace it with a new one for the new user or associate with the new user.