Trying to understand how to setup SSO for SAAS application used by another organization, which currently uses OKTA themselves. The use case is, they want their employees to be able to sign into the platform via OKTA. Read some of the OKTA docs but confused about how their employees will be able to login. Do they have to exist in the OKTA universal directory, in which case my application doesn't need to care? or Does my application need to import users from the other company into OKTA groups?