Yes.
When configuring SSO, there is an option to select the User Role. Selecting "No Access" will not allow any authenticated SSO user unless there exist a manually created user under the User's page in the PCE with the type of "External".
More on SSO from the document below:
https://support.illumio.com/documentation/16.09/ug/Default.htm#Topics/user_management/configure_sso_onelogin.htm