Client certificates are your best bet - they allow the iPad to prove its identity without transmitting the confidential part (the private key). Even if the network is tapped, HTTPS is somehow broken or the destination server is compromised, the attacker won't be able to steal the key. It is also seamless and you don't even see the authentication - it all happens in the background during the TLS negotiation.
Smart cards would be a good idea to further protect the private key (if the iPad is compromised the key could still leak) but iOS has no support for them currently.
You can add two-factor authentication on top of that using TOTP for added security if your threat model requires it.
Biometrics add little security as they can't be changed if compromised (and given that we leave our fingerprints everywhere, it's good to assume they are indeed compromised), not to mention quite hard to pull off on iOS as there is no built-in support for it (Touch ID can only be used by apps, not websites, and only authenticates the user to the iPad - there would be no way of sending the fingerprint data to the server for verification).