Can I control which user gets challenged with LoginTC?

Yes. The Passthrough component of a configuration allows you to specify which users to challenge or not with LoginTC.

This can be accomplished with either a Static List or Active Directory / LDAP Group.