Employee SSO setup in pulse check

We are currently setting up a pulse check as engagement project. Meanwhile, we are also configuring SSO. Now I have few questions on the details of the SSO authenticator in the survey flow. 

1. If we do not tick the “Associate respondent with person by field” option, could anyone in the employee directory then access the survey after successful SSO? 
2. Is it possible that the survey can be taken by some employee without prior adding them as participant to the project? If I understood correct, this would be possible if we use the anonymous link, send it from another mailing system than Qualtrics to all employees (so that they do not need to be added to the project) and have the SSO authenticator element without option  “Associate respondent with person by field” ticked. As long as the employee has a contact within the employee directory, it should be possible to start the survey, correct?
3. The contacts in the employee directory do have custom metadata fields such as department. We have enabled pseudoanonymization, however, this does not include the department as we would like to populate it for each response so that we can use it in the dashboard. Is it sufficient to define the department field as embedded data within the survey flow after the SSO authenticator element? So does the authenticator match the person who tries to access the survey with some existing contact of the directory so that we can work with the embedded data of this contact? We do not want to pass department information via SSO “Capture respondent identifying info” as we already have all information integrated to the contacts. 

I know that it would be the easiest way to just test, however, as long as the setup is not finalized, I would like to already get some better understanding.

Thank you.