I think the strongest option here is to use an external authentication provider (OAuth whatever) with the “auth overrides username” option:
Overrides local full name with external site full name on every login, and prevent local changes. Applies to all authentication providers.