It appears that extensible SSO is the configuration to use, but it is unclear as to how exactly it needs to be configured. I have tried with the initial app called out in the 'App Extension Bundle Identifier' field and different variations of the company's OKTA address in the URL prefix for Redirect SSO type and Host Name for Credential SSO type. I haven't been able to find great documentation.