What happens when someone logs into Piwik PRO for the first time when SSO is enabled?

At the first login, a user is created with permissions to modules only.
This user can’t see any data, other users or apps & sites/meta sites or apps,. An Owner (or any User with manage permissions) can grant them access to the Site or App or meta site or app or Groups.
For more about permissions see Users and groups.