Invites are sent to a work email. The recipient accepts, sets their own password, then appears under your organization with the access you assigned. There is no single sign-on today.
Roles limit which fleets, sites and settings a user can change. When someone changes jobs internally, update their role before adding ad-hoc admin access.