This how to document will walk you through setting up a smart group based on criteria from an extensioin atrribute that will find all local users that do not have a secure token in their Authentication Authority. Be sure to download the how to guide and the extension attribute to following along. Enjoy!