The setting you're looking for is the AllowSingleSignon policy. Disabling this will cause the VM to require reauthentication at the desktop and will enable the use case you're looking for.
Details on this setting can be found here:
View Agent Configuration ADM Template Settings
You will need to install the View Agent ADM template in AD and apply this policy for it to be active. You can also assign the template to just the single VM if needed.
-Mike