Hi Jay, ok, maybe I used wrong words. sorry. 
I am thinking about an option, something like
Disable/Disallow local login for users who have active associated SSO (external?) account(s) .
Making a plugin is a good idea, I will check it, thanks!
No, there is no budget…