Can APM be used to restrict access to users that fail Kerberos authentication?

Currently our access policy is configured to use SSO with Kerberos authentication to log users into our sharepoint site. The problem we are having is that even when users aren't receiving a Kerberos...