What to do when someone leaves the company?

If SSO won’t allow them to log in, why not just do nothing?

You could add them to a “former employee” or “alumni” group that had a badge signify that they’re no longer at the company.