Sounds like you need to tell the RSA agent about the document signing application (or maybe Adobe) so that if does not try to challenge users who access it. In the registry Under \Local Authentication Settings you would Create a REG_SZ value named RDCFileName and populate it with the FULLY QUALIFIED path to your app.
Look at https://community.rsa.com/message/904593?commentID=904593#comment-904593 for some background detail
Basically the RSA agent is a Credential Provider, CP that uses the concept of Challenge to determine if someone needs to enter a PassCode or a Password to access the Windows system. Windows is signaling that something privileged is being accessed, and our agents only default response is to prompt for Credentials with the RSA CP, which does not know how to interact with your document signing app. I think exempting your app from our prompt will correct this, and assuming your app is Adobe then I'd try that with full name and path.
The GPO template manual is here
https://community.rsa.com/docs/DOC-77534
I think you will want to look at Logon with credentials from remote applications under RSA Local Authentication Settings Templates starting on P.9
.png){kind=link}
