How do we handle an enrolled employee getting a new card after they lose the one they enrolled with?

You must delete user and the user must re-enroll. 

For 1FA, the user may self-enroll after deleting the profile.

For 2FA, the user must enroll at an enrollment station.