Is it possible to let certain employees login via Single Sign On, but not all?

Yes, you can organize this yourself. Your IT team may decide who is authorized in your directory to use certain apps via Single Sign On.