When you enable single sign-on for a hub, you should prevent users from signing in using other email accounts.
Once single sign-on is enabled, you should ensure that users are required to authenticate using the Identity Provider, and cannot use another existing account tied to their email address to log in. This reduces the chance of confusion for users about which account to use, and simplifies the administration of user accounts by only using the Identity Provider.
You can also, optionally, prevent users from updating their email address in the Account Settings page. If you turn on this option, you can add a message indicating how they can request an update to their email address.