As a coda to this, for various reasons, we ended up changing Discourse so that we do enforce some of our core spam rules (primarily around blocked IPs and blocked emails, visible in Admin, Logs) even for SSO.
The domain signup blacklist is not currently enforced for SSO, though.