NPS certificates installed automatically on BYODs

Hello,

I recently set up a NPS server for our wireless authentication. I set up the following policies:

1)User must be part of a wireless_user AD group

2)Computer must have a certificate installed (manually installed)

It works, However I just discovered when an IPad trys to connect it prompts for  a username and password. If the user is part of the AD group and enters his username and password the certificate automatically installs on the device. This works for Android devices as well. Is there a way to not have the certificate be pulled down automatic.

Im very new to NPS and been searching on line for hours.

Thanks,