This just echo's izmarine's point about not seeing any way to not list NTLM for authentication but from the CLI. The following command shows more options than "Enable authentication" and "TLS authentication only" but do not have anything related to NTLM:
zmprov gs $server | grep -i auth |