Did you change the native VLAN to IoT or just added the tag and left the native VLAN on the switch port set to default? You should be able to change the native VLAN and leave tagged VLANs as “allow all”.
My only other thought is how did you isolate the IoT network and are you able to access other devices from default to IoT?
I love my Yubikey but the older hardware versions can only store 25 passkeys, and I believe even the newer ones can only store 100. That seems like a lot until more sites start allowing passkey auth.