Apologies for any inaccuracies—this is from memory, from over a year ago: When implementing my SSO I found that if the SSO payload omitted or left the “name” field empty, that there was some code in Discourse itself that would populate it with a value inferred from the user’s email. The workaround was to have the SSO explicitly populate the “name” field as a copy of the username.
Because names-off does not seem to be the most-tested configuration, I’d recommend a bulk sync of you users from your SSO and looking in the db table to verify that you’ve clobbered all the email-derived names, just in case there are any future bugs that leak the name field.