We implement our own Discourse SSO provider – so, it’s that system when can be adapted to send a unique email to Discourse. (e.g. user@gmail.com gets replaced with user+internal_id@gmail.com). When a user signs in, they don’t see any of thing, since they sign into our SSO system using their username.
Ultimately, this isn’t perfect, since that doesn’t deliver emails for everyone, but it does avoid real email clashes when you have systems where the email is not unique. (Sadly, the particular app that I am working with also has fewer user name restrictions than discourse, so clashes are possible, though so far very unlikely.)
I think the best long term solution may be to have a plugin which stores a separate notification email address, and have SSO send over a unique (possibly even faked?) email address and one for notifications that does not need to be unique. I’m not sure yet whether that will seriously break things, but ~30 minutes of skimming code suggests it’s plausible, if not a painful solution.