With the increasing use of biometrics in Internet of Things (IoT) based applications, it is essential to ensure that biometric-based authentication systems are secure. Biometric characteristics can be accessed by anyone, which poses a risk of unauthorized access to the system through spoofed biometric traits. Therefore, it is important to implement secure and efficient security schemes suitable for real-life applications, less computationally intensive, and invulnerable. This work presents a hybrid template protection scheme for secure face recognition in IoT-based environments, which integrates Cancelable Biometrics and Bio-Cryptography. Mainly, the proposed system involves two steps: face recognition and face biometric template protection. The face recognition includes face image preprocessing by the Tree Structure Part Model (TSPM), feature extraction by Ensemble Patch Statistics (EPS) technique, and user classification by multi-class linear support vector machine (SVM). The template protection scheme includes cancelable biometric generation by modified FaceHashing and a Sliding-XOR (called S-XOR) based novel Bio-Cryptographic technique. A user biometric-based key generation technique has been introduced for the employed Bio-Cryptography. Three benchmark facial databases, CVL, FEI, and FERET, have been used for the performance evaluation and security analysis. The proposed system achieves better accuracy for all the databases of 200-dimensional cancelable feature vectors computed from the 500-dimensional original feature vector. The modified FaceHashing and S-XOR method shows superiority over existing face recognition systems and template protection.