Answer
That prompt is generally governed by a user-setting default for the created account's own database password, not by your SSO configuration itself — set that default to a random, non-guessable value (rather than reusing another known password) so the created account can't be used to log in directly against the database.