You already do that!
If user A comes in, you respond with usera@mail.com for email and when user B comes you respond with userb@othermail.com. Your SSO payload is already diferent for each user.
Something that is probably easier, is dropping both moderator and admin from the payload altogether and manage this only trough Discourse. I believe that it will work, too.