To the degree that the server can differentiate them, yes. For attested authenticators, the server needs to have a way to keep a list of them. I know some bank

To the degree that the server can differentiate them, yes. For attested authenticators, the server needs to have a way to keep a list of them. I know some bank/finance sites (Vanguard I think is one) restrict to Yubikey or historically have restricted to that. For non-attested authenticators, the server could unreliably fingerprint the response and decide to selectively allow. Obviously this is completely spoofable, if it's differentiable at all.