The Essex is only a passthrough...the site code will always be transmitted, with the variable being the physical code, which is no different than a card # on a prox card....actually, if you had a prox card with the same site code and credential #, you could install a 26 bit reader and that would work the same as entering in the code on that physical keypad. Probably not a concern, but a FYI.
In the M1's case, the calculator they have figures the card offset and to me, without really caring too much to look deeper, appears to provide the values with the offset into HEX for the M1 to be able to recognize..
The KAM only changes the weigand to a stream on 485 that is passed through to the M1 for the decision to execute a rule, nothing is resident on the KAM.
I suppose you could also try a "wrong keypress" lockout, but that might shoot yourself in the foot with physical M1 keypads.