Need to setup salesforce sso, so that users have to use SSO to login, but cannot use standard login.salesforce.com to login. Not able to setup how to prevent login from the standard page with salesforce credentials. Reason we want to do this is to ensure employees who left company can no longer have access. (Basically when we disable sso login as a part of termination process, it should disable salesforce account as well)
Solution is to setup SAML SSO and also enable Delegated Authentication. Need to apply the "Enable Single Sign On" permission to those users you want to force to use SAML SSO using either profiles or permission sets. Administrators should be excluded from this process, so that they can always login (even if sso is down).
Note : My Domain setup doesn't help in this situation (so that's not the option).