One major drawback with this approach seems to me, that disabling anonymous pad creation (and drive) is only enforced client side (security risk), while the guest access restriction is enforced server side. Nevertheless, with guest access restriction on, you cannot share access links with unregistered users.
So seems currently you have two possibilities: All users need to be registered, even those outside SSO need an account, or enable guest access with the risk somebody manipulating the client and storing documents as they like.
