The PermitOpen feature only specifies the actual username, and not any aliases that might be assigned via smart cards. Hence these two features are currently incompatible and results in the user just getting disconnected right away.
A first step could be to document that these two features don't work together.