Windows Hello and Terminated Users

If you don't already have it, that's a bigger problem. You can prevent users from saving to local disk while turning on Known Folder Move. Then you don't have to worry about it as all of the data is in OneDrive or SharePoint, which you already control access to and *should* have a backup solution for. However, you also have the option of putting certutil.exe -DeleteHelloContainer in a script and deploying it either as a script or wrap it as a Win32 app. But that's really not a great long term strategy. Data protection should be way more proactive than what you're doing now.