Which setting will allow a virtual machine to have direct secure access to an RDM?

NIOC (Network I/O Control) is a vSphere networking feature that manages bandwidth allocation among different types of network traffic; it has no relevance to Fibre Channel storage or RDM access.

NPV (N_Port Virtualization) is a Fibre Channel switch feature that allows edge switches to proxy N_Port logins through an upstream core switch; it is a switch-level fabric feature, not a VM storage access mechanism.

NPIV creates virtual Fibre Channel ports (vHBAs) for VMs, assigning unique World Wide Port Names so that SAN zoning and LUN masking can be applied per-VM. This gives a VM direct, isolated, and secure access to an RDM without sharing the physical HBA identity with other VMs.

CPUID Mask is a vSphere feature used to hide or expose CPU instruction sets to VMs for vMotion compatibility purposes and has no connection to storage access or RDMs.