Can I enable SSO for only one set of customers but not all end users?
No. It is not possible to enable SSO for only some end users. If you enable single sign-on for end users, it is available for all end users.
However, you can differentiate between end users and staff members (agents and adminstrators). See more in the article: Can I turn on SSO separately for agent login and end-user login?
You can also keep Zendesk authentication enabled at the same time as offering single sign-on options. Retaining Zendesk authentication is recommended as a fall back for SSO issues. Read more in this article: Accessing your Zendesk account when your SSO service is down.