Guide them to their preferences > under the email title, they will find their primary email. They can change that by pressing the little icon, then press change email.
I don’t have SSO, but I believe the email addresses are updated from the main log-on, and then sent to Discourse from there (depending on your particular settings).