Answer
Yes — disabling the local username/password login fields is a supported way to force sign-in through SSO/external identity provider only, rather than leaving both paths available side by side.
Yes — disabling the local username/password login fields is a supported way to force sign-in through SSO/external identity provider only, rather than leaving both paths available side by side.