I think the solution is to configure your SSO so that it sends a reasonable username. Aren’t those usernames that you don’t like sent to Discourse by your SSO? Also, if sso overrides username is un-checked, then users can change their username (within some limits that are configurable).