A PFX file is better known as a PKCS#12, the "Personal Information Exchange Syntax". It is used either as a trusted certificate store or as a key store. When it is used as a (private) key store it generally contains entries with a private key and the certificate chain associated with it (leaf certificate, CA certificates and root certificate usually).
If your key is in a hardware token then generally you cannot extract it. So your software needs to reference it some way or other. For this another standard from the PKCS range is commonly used, namely PKCS#11. PKCS#11 is also known as Cryptoki. Microsoft unfortunately has a bad track record when it comes to keeping to standards and uses a CSP (Cryptographic Service Provider). PKCS#11 libraries and CSP's are token specific and should be available from the vendor.
To use the device your software should support a PKCS#11 interface or it should use the Microsoft Cryptography API in a generic way (it is possible to use the "managed" classes, but then you'll be stuck with a software-only implementation). OpenSSL also has a PKCS#11 engine if that's your poison.
PKCS#7 is the "Cryptographic Message Syntax". It is used to sign / encrypt data. However, because it can also carry certificates it is sometimes used as a certificate store as well. It is not a key store, so the private key won't or shouldn't be in it.
X.509 is a standard of certificates and CRL's. It can specify a lot of things, but it cannot be used to specify where the private key is stored. As such the last part of the question is unclear and cannot be answered in my opinion.