Can SSO be excluded for certain users

If certain users should log in with a standard username and password, then you can still set them up as regular users in Acumatica, even with the SSO features enabled.  If you don’t want these users to sign in with single sign on, then just don’t add them to the Active Directory groups and they won’t inherit any access rights.  They may still be able to “log in” since they exist in the system, but they won’t have any access rights.

where would i find the “Active Directory Group” would that be in the user screen?

This whole chapter in the Help articles is probably a good place to get started (for Azure single sign-on), if using a different provider, then select the appropriate chapter” https://help.acumatica.com/(W(3))/Help?ScreenId=ShowWiki&pageid=68201e8c-05e5-42da-8028-360241a2aefe

• Users are added to AD groups by your IT system administrator.  This is done outside of Acumatica.
• AD groups are mapped to Acumatica roles on the User Roles screen: https://help.acumatica.com/(W(3))/Help?ScreenId=ShowWiki&pageid=cd2f197a-3792-42d6-87b3-73e0973cf7b6