This is what I use, and I include Jamf Connect/Jamf Connect LaunchAgent in Prestage. Using an enrollment customization you can have your users authenticate with their SSO IdP credentials so their user information gets passed to Jamf Connect to create the first account. User experience should be: Get Remote Management Screen, authentication with SSO, validate password one more time, user is in the desktop and you have your policies kick off.
Any articles/comments/YouTube videos with Sean Rabbitt are a great resource on this topic