That sounds right. The best solution would be to make it so your sso works. It doesn’t make much sense that it’s “not feasible” for your sso not to work for your employees,but maybe that’s why I work down myself. 
(But your employees don’t use your app? If they did, it should be easy enough to add their email address with the API).
But people making bad decisions are who keep me in business! When I’m not talking people into using existing features, what I really like make discourse do things it’s not designed to do (like install discourse).
I would be happy to develop, or help you develop, a plugin that would make the /u/admin-login route (or another one) work for members of your team group (that automatically includes users with your company email), and make a page they could visit and enter their email to get a login link.
Maybe it could even redirect anonymous users on your vpn to the login page automatically or something else to make it more seamless for your employees.