Send a shieldedInstanceConfig with the selected options when provisioning the VM. Leave unchecked to omit the field from the request.

See the Shielded VM documentation.