We have the same issue as well, and as of the last time I asked Support about it, this was functionality as designed. Links from emails will always go to the SSO portal even if the User account does not have SSO enabled. Which is incredibly confusing to all our external users, and something I'd love...