Two considerations for preventing users from accessing Salesforce from outside of their network are:

IP address restrictions are set on the profile or globally for the org, which limit login access based on IP ranges specified by an administrator

Restrict U2F Security Keys on the user’s profile to enforce login hours, which require users to use security keys during certain hours of day Assigning single sign-on to a permission set or enforcing Login IP Ranges on Every Request will not prevent users from accessing Salesforce from outside of their network. References: https://help.salesforce.com/s/articleView?id=sf.security_networkaccess.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.security_keys_restrict.htm &type=5