YubiKeys are ideal for any use case where the computer will have a USB port.  Offline logons to laptops disconnected from the LAN work most easily with YubiKeys as well.

Google Authenticator (or other soft token app) is a great choice if you need to save money on the cost of tokens for some users, or if you need to authenticate at systems where a USB port is not available.

When neither of these options is appropriate (no USB devices allowed, no smart phones allowed) you can use a battery-powered LCD displaying OATH token