I’m on a site with email disabled, and I think that is only possible because of the SSO handling login and password resets, etc.
Without needing those, I think using onsite notifications and having no email notifications for anything works quite well. 