How to force Google SSO (SAML) only?

Good evening, 

Currently we're on sugar sell 14 migrated from a Sugar Pro OnPrem. 

On the OnPrem, the Sugar login Form was Off. So the users could access the system only via Google SSO (SAML). 
We'd like the same config on Cloud but it seems that we can't disable the Sugar login Form. 
The user can also reset its password. 

A workaround I found is removing the Local Authentication Username leaving only the Saml Authentication one (the mail).
It works: the user cannot log using the Sugar password neither he can't reset it. 
I'm not sure we want to lose an information like the username tho. 

Any advice?