how to assign user category differently for pending worker and employee

Summary:

how to assign user category differently for pending worker and employee

Content (please ensure you mask any confidential information):

Hi Experts,
May I know how to restrict employee not to use application credentials when SSO enabled? But pending must be able to reset password and user application credentials.
Will that work with different user category creation, if yes, how to assign automatically different user category for the employees.
Thanks,
Kavitha

Version (include the version you are using, if applicable):

25B

Code Snippet (add any code snippets that support your topic, if applicable):