You would need to create a plugin that would do something like test if they were a member of some group and then log them out of they were in the must_use_saml group and didn’t log in with saml.
It’s probably about an hour or two for a developer familiar with such, depending on how much testing is required and whether specs are created.