Would implementing SSO mean that all our users now have access to every lab within the facility?

No! Users will only have access to the labs they had previously been given permission to access. Lab access on Calira is still managed by invitations as previously.