Is there a way to ONLY allow AD login to the CMS?

Yep! When you set up your custom provider (inheriting from

BackOfficeExternalLoginProviderOptions

) in the

Configure()

method I've got

options.DenyLocalLogin

set to

true