I figured it out. Here are the steps I used for anyone else that comes across this:

1. In the Okta admin portal, add a new application.
2. Select the option to Create New App.
3. Set the Platform to Web and the Sign On Method to SAML 2.0, then press Create.
4. Name the app whatever you want, e.g. Tenable.io, and set a custom icon if desired, then press Next.
5. For the Single sign on URL, enter https://cloud.tenable.com/saml/login/. NOTE: You will need to change this later.
6. For the Audience URI (SP Entity ID), enter NessusCloud.
7. Leave all other settings at their defaults and press Next.
8. Go to the settings for the newly created app in the Okta admin portal.
9. Go to the Sign On section of the app configuration.
10. Right-click Identity Provider Metadata in the SAML 2.0 section and choose the option to save the link as a file (the option name is browser-dependant). This will save an XML file named metadata (no extension) to disk.
11. Rename the file downloaded in step 10 to idp.xml.
12. Create a Tenable support case requesting they enable SAML for your Tenable.io tenant, attach idp.xml to the case, and supply a valid Tenable.io username for your tenant (e.g. your own) in the case notes.
13. When Tenable support supplies the service provider metadata XML file (mine was named metadata (27).xml) as a response to your support case, open the XML file with a text editor and get the full, correct Single sign on URL from the XML from the Location attribute in the md:AssertionConsumerService tag.
14. In the Okta admin portal, go to the new app's configuration and go to the General section.
15. Press Edit in the SAML Settings section.
16. Press Next to skip to Configure SAML.
17. Replace the Single sign on URL with the URL retrieved in step 13 from the XML supplied by Tenable support.
18. Press Next.
19. Press Finish.

The custom Tenable.io SAML 2.0 Okta app is now ready for assignment and use.