Answer
Yes — accounts that need to keep using database authentication after SSO is enabled for everyone else log in through the EE Admin access point specifically. It's also possible to adjust the landing/login page's displayed text to make this distinction clearer for your users (for example, explaining where DB-auth-only accounts should go to log in) — the relevant plain text can be found and edited directly in that page's source.