Prevent access to users with no role

For some reason, WordPress users on my site set to “no role” still have access to my entire website even though everything I read online says they shouldn’t. I tried creating a new role called “deactivated” that we can move users into if they should be removed from having access, but even with 0 capabilities set in User Role Editor, those users are also still able to view my entire site.

How can I prevent a user with “no role” or “deactivated” from having access to anything if they shouldn’t after logging in with our SSO?