When the application detects that the pairing should not be performed, for example an insufficient IO combination, it can use sd_ble_gap_sec_params_reply() to send SMP Pairing failed to the peer.

When the stack handles the response from the application it will also validate the passkey (BLE_GAP_SEC_STATUS_PASSKEY_ENTRY_FAILED). If any error is detected it will be reported when sd_ble_gap_sec_params_reply() is called.