Prevent redirect to local login page if local user doesn't exist

Hi All,

We manage Drupal web sites for large university which has thousands of students, all of which have valid CAS accounts. Each of our departmental Drupal sites have their own users.

With Drupal 7 we have been able to configure CAS so that it works in this way:

Condition 1: User accesses the /user page and is redirected to CAS. If the user has a valid CAS account, AND they have an account on the Drupal site, they are logged into the Drupal site.
Condition 2: If the user has a valid CAS account, and they do NOT have an account on the Drupal site, the user is sent back to the CAS authentication page with the message "Application Not Authorized to Use CAS. The application you attempted to authenticate to is not authorized to use CAS."

With Drupal 8, we have not been able to figure out a way to configure CAS to work like this. This is what is happening.

Condition 1: User accesses the /user page and is redirected to CAS. If the user has a valid CAS account, AND they have an account on the Drupal site, they are logged into the Drupal site.
Condition 2: If the user has a valid CAS account, and they do NOT have an account on the Drupal site, the user is sent to the Local Drupal Login page. We do not ever want to expose the local login screen. Optimally, we would like to the user be redirected to a custom Access Denied page that we have (just a basic Drupal page).

We attempted to setup a redirect that says anytime a user is sent to /user/login that they are redirected to the Access Denied Page. However, this prevents the user from ever being redirected to CAS login in the first place so that isn't an option.

Any recommendations?