Isn't that generally what external auth providers are designed for?

I imagine it isn't much of a concern if Immich isn't exposed to the internet.