Responding my own thread here. :)
We just (finally!) turned on auto-provision! We only map first and last names, and the email address of the user. It does set the user with a Request license, Requestor access level. I have a daily report of any new people with Requestor access level, and manually...