Lock email from end user updates

We would like to remove the ability for end users to change their email address on their accounts. We use SSO to log in and when users update the email incorrectly, it breads the SSO login. It would be global, not just US.