Let's verify it's really you

Create a single-use link for one end user. They scan the QR (or open the URL) and go straight to face enrollment.