Currently the only way to force users to selected a passphrase is through the registry.

Here are steps:

***
Go to start\settings\control panel\administrative tools\local security policy\ security options
Select in "system cryptography" user must enter a password each time they use key
***

With the enrollment page, we can have the security option come up for the user, but the default option presented is "Medium" which is no passphrase. They would need to select "High".

See solution  How to set default for KCA enrollment to protect private key for more details