We deployed SSO for Ondemand 12.1 in February and upgraded Clarity itself to 13.3 a couple of weeks ago.
Yes, this portal is adding an extra layer and you need to maintain the users there as well as providing proper rights in Clarity. To log in to the portal itself you should use your preferred SSO-technology, we used ourselves MS ADFS. Depending on the amount of users you have it might or might not make sense to move to SSO. We have 1700 active users so for us it is overall beneficial even if the technical configuration and deployment was quite heavy and there are more maintenance activities with the portal