Hi Ken!
I actually forgot to mention that our testing has been with moodle 3.3 (we are migrating versions!) we included that successfully, we actually have a google domain for edu, the platform (our single sign in app) does not start session unless the students/ profesor clicks the course link in our panel so they are prevented from starting the sessions in moodle sites they don't need.
We also implemented the sync tool you tell me about, we are looking more into google because we want to switch our old ldap authentication because is quite old and we want an alternative place if we ever have to put it down or change it at some point (so we keep the service active always).
Thank you for your advices and suggestions!