Assuming you are not doing Android development, you do not need to worry about Android version.
Any serious security-minded application like Chrome on Android will use TLS 1.2. You can verify this for yourself by going to a secure website (make sure it supports TLS 1.2!) and inspecting the certificate and protocol used on the client. I have checked this on Chrome on a 4.4 Android device, and it uses TLS 1.2.
A security policy should basically rely on the TLS version, and not pay attention to what kind of client is running it. It's not worthwhile to determine the Android OS version, because the Android OS version is not what finally determines the security used.
Let's be pedantic about enumerating the possibilities.
- Android API 20+: All browsers and applications should work with TLS 1.2
- Android API 16-19: Some browsers and applications will work with TLS 1.2.
- Android API 15-: I think we are not discussing these because no version supports TLS 1.2
Here are the server choices I think we are discussing:
- You allow only TLS 1.2 and do not check Android version. All Android API 20+ clients, and those Android API 16-19 clients using TLS 1.2 applications are expected to work.
- You allow TLS 1.2, 1.1, 1.0 and do not check Android version. All Android clients are expected to work. System is less secure.
- You allow only TLS 1.2 and check the Android version. Only Android API 20+ clients can work because you are excluding API 16-19. This is fewer supported clients than in option 1, with no increase in TLS security. So this option does not make sense.
- You allow TLS 1.2, 1.1, 1.0 and check the Android version. Only Android API 20+ clients are expected to work because you are excluding API 16-19. This option does not make sense because you are making the system both less usable and less secure than other options. Fewer clients will work than under option 1, and those clients will be less secure.
Checking the Android version makes your system support fewer clients, at no increase in security. Therefore, do not bother checking the Android version.
The basic security tradeoff is always how usable a system is versus how secure the system is. This applies to physical security measures, cipher suites, TLS versions, and more. TLS 1.1 and 1.0 are not as secure as TLS 1.2. You have to answer the following questions for yourself:
- Do the vulnerabilities in present in TLS 1.1 and 1.0 make them unsuitable for your system?
- Would using only TLS 1.2 be worth the tradeoff in some people not being able to use your system?